Malicious PDF — malware analysis report

Static analysis result for SHA-256 e806be3e9d118d4d…

MALICIOUS

PDF

79.2 KB Created: 2021-03-19 18:21:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9b82ca8a890dc032c950e52caa37f58b SHA-1: b05f5ca92dc3708b1adfa548bcb76f3c3db9d1fa SHA-256: e806be3e9d118d4dcc4be21ee9c66c7562326bca71c870d21968c591439243a4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains a large number of external links, suggesting a link farm or SEO manipulation tactic. One of the extracted URLs, https://maypoin.ru/wix?keyword=ace+in+the+hole+sump+pump+battery, is directly embedded in the document, indicating a potential lure. No scripts were extracted, but the PDF structure itself is used to host and present these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=ace+in+the+hole+sump+pump+battery
    • https://bobiputab.weebly.com/uploads/1/3/2/8/132814039/fatame-lerupinonulav-pekesonenujugof-pawasijifuboxeb.pdf
    • https://posilukununafux.weebly.com/uploads/1/3/4/4/134498017/nutefubudizaroj.pdf
    • https://ronizizuvuf.weebly.com/uploads/1/3/4/7/134707383/lokaz-tetefopoga-werinevolaze.pdf
    • http://lazategomid.scienceontheweb.net/divel.pdf
    • https://xurulojoxog.weebly.com/uploads/1/3/5/3/135323168/3217576.pdf
    • https://rupuleda.weebly.com/uploads/1/3/6/0/136002844/fokadojerevisub-vexubomidexoneg.pdf
    • https://fibimijisu.weebly.com/uploads/1/3/4/4/134461798/wegororofenili.pdf
    • http://gepexoliv.medianewsonline.com/jotifexokageda.pdf
    • https://xixusumer.weebly.com/uploads/1/3/0/8/130814933/zozegigafiduwuw_sarerato.pdf
    • http://gixodugesu.medianewsonline.com/accounting_standard_29.pdf
    • https://visofamawuri.weebly.com/uploads/1/3/2/3/132303269/rakezuziges.pdf
    • http://vajesafosedepur.mywebcommunity.org/73201254124.pdf
    • https://kiloroxo.weebly.com/uploads/1/3/0/8/130813762/3221373.pdf
    • https://pugixodazujok.weebly.com/uploads/1/3/2/7/132710779/pumukuxamojosa-zadumunodavasu.pdf
    • https://lopomibuliwipa.weebly.com/uploads/1/3/1/3/131381919/196325.pdf
    • https://bagibobujinokat.weebly.com/uploads/1/3/5/3/135312275/ba7b43eadd6c6ff.pdf
    • https://pupikitonusu.weebly.com/uploads/1/3/5/3/135301263/gisexadinazuv-zanamigoketeta-zesojik.pdf
    • http://rowomonug.mywebcommunity.org/simple_c_programs_for_interview_with_answers.pdf
    • https://xigujevaw.weebly.com/uploads/1/3/4/7/134701692/11a09d2788ea.pdf
    • https://vawegoti.weebly.com/uploads/1/3/0/8/130874218/wofozomoboxibuz_wanasasibof_fisomorosikarom_mudilixufipu.pdf
    • https://senaduwofajix.weebly.com/uploads/1/3/0/7/130775021/jutuxud-fidezafi-jimareme.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e99ab4aa-2e0f-4542-b3a9-62c092347089/ludelaxeverafemubimota.pdf
    • https://uploads.strikinglycdn.com/files/8c902683-65f3-4c34-9e29-9b71913d3eaa/honda_service_code_b1267.pdf
    • https://uploads.strikinglycdn.com/files/d32a17ce-02a7-48e4-9620-5af5d30d35b1/ford_mustang_mach_e_interior_dimensions.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6b1.bin
18aa372c2707a12e866733116f58b570ddb7d159dbf0f7cb7c430a2fe78c2d24		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6B1 5404 bytes
font_01_sfnt_off000108ec.bin
debf5463f2fe5edaf30bcb71cbbb8d94bbd668133d2fdccee0ca91358e11eff7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108EC 10896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.