Malicious PDF — malware analysis report

Static analysis result for SHA-256 e98a8bf2b90b09ee…

MALICIOUS

PDF

79.6 KB Created: 2021-04-27 16:00:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 06ee7430e3bd514216736d055a47d4e9 SHA-1: 7c8b930b9a0c27cb0ee1c83fa45b2bfb8a6da723 SHA-256: e98a8bf2b90b09ee1916b3942d2bf404de67138dd8f7a8f4b7f9295d7f747b7f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. The presence of a large number of external links, specifically a 'PDF link farm', suggests an attempt to redirect users to potentially harmful websites. While no scripts were explicitly extracted, the PDF structure and the nature of the heuristics point towards a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=dayton+band+saw+3z360d+manual
    • https://cdn.sqhk.co/terasovo/ipcANbO/blood_glory_2_apk.pdf
    • https://cdn.sqhk.co/dibitarebizu/jjjCshd/super_mario_64_world_maze.pdf
    • https://cdn.sqhk.co/mopijiluxu/FhIDieD/marco_polo_world_school.pdf
    • https://cdn.sqhk.co/mifodirula/eNeOXhc/61264055948.pdf
    • https://cdn.sqhk.co/budufunewuf/7iigdib/clarkstown_police_report.pdf
    • https://cdn.sqhk.co/xajevedu/SPNgdjj/ghost_rider_2_netflix.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://557345b1-98c6-442d-b460-9e357c178e5b.filesusr.com/ugd/dfb5f8_d06c91318bac445e81b9b991a8efdc84.pdf?index=true
    • https://34e51215-b586-4e01-b3ea-a219475a7b91.filesusr.com/ugd/46481b_6293e5b14980487fb2aaca42b0691152.pdf?index=true
    • https://677e6977-fc43-48b2-ac81-16e478c8573b.filesusr.com/ugd/3750c2_cfc11a411d7c44f8b3437498515abc2f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bb5c0004-5277-465f-92d6-07ed562bbb12/per_capita_household_income_by_year.pdf
    • https://5fb42ee6-a9be-400a-98f2-f9d4b9f720c8.filesusr.com/ugd/1813b3_1f7da898502c465cbd7817700fc30b3c.pdf?index=true
    • https://fd0ef26f-7b8f-4c91-b3b2-19f7ec93487a.filesusr.com/ugd/4174bf_cb414f8f4d8a49a88505f20767645164.pdf?index=true
    • https://uploads.strikinglycdn.com/files/70f384a9-c36f-4b42-8797-30d1bc5e8ca9/who_is_the_narrator_in_barn_burning.pdf
    • https://d5fd0048-bb8d-45a1-ba21-28d1cb0b7162.filesusr.com/ugd/5e8de6_334a8930eadd48c5a01688c4353b93b2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e7c024e3-6f4e-43b6-8f0c-9b9f646f3de3/larafe.pdf
    • https://s3.amazonaws.com/wivunonovef/reading_comprehension_passages_with_questions_and_answers_for_grade_10.pdf
    • https://s3.amazonaws.com/fupanabivote/committee_on_climate_change_progress_report_2018.pdf
    • https://6c9aa500-f8d9-42a6-b8a4-5b3c562bbfc3.filesusr.com/ugd/543886_6421699145be4be19a9491d033add714.pdf?index=true
    • https://bad3f395-1638-4667-b349-d6f934eeab49.filesusr.com/ugd/ed2d23_e73fb2217aa34e2682c280b71e99bfa1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f548.bin
d0416a06f7e833da26e62e6b4937c53fca95527b03d81219c2f74b83c472d23a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF548 5720 bytes
font_01_sfnt_off000108cf.bin
ddb1484675650b129d80dda7da15fbdc0514a504631d635447af174b7f815d65		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108CF 11936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.