Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9b66c62bc0b0e3f…

MALICIOUS

PDF

81.0 KB Created: 2021-03-06 09:47:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 94258bf7449bee39722e4222ab90a3b9 SHA-1: b50954a3cfa93abe8e393141baa2f6fa4207efdc SHA-256: e9b66c62bc0b0e3facb0fcaea43e3d3885dd92c910007706a05a2e18a4a3f9a9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, many of which are to PDF files, suggesting a link farm or SEO manipulation tactic. One of the primary external links, 'https://jumiwimov.ru/123?utm_term=power+yoga+poses+youtube', is likely the intended lure for users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=power+yoga+poses+youtube
    • https://larulesa.weebly.com/uploads/1/3/4/7/134717423/4aea516.pdf
    • https://dopakuxapat.weebly.com/uploads/1/3/4/8/134895633/1add90709d01.pdf
    • https://murafasonuralab.weebly.com/uploads/1/3/5/3/135398902/3458993.pdf
    • https://cdn.sqhk.co/foxoxaze/RniaIhj/skater_dress_with_sleeves.pdf
    • https://cdn.sqhk.co/kogewole/g742YZR/idle_gun_tycoon_mod_apk.pdf
    • http://nufemewi.iblogger.org/powerflex_4_fault_code_f004.pdf
    • https://wesotapaxo.weebly.com/uploads/1/3/4/4/134488604/tiwoneri_karusubivagim_kunekik_bufiwewuxevij.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://5663e088-3595-439c-971a-5873693bee35.filesusr.com/ugd/e98895_39a956bd9d5440a7b0ae6a14391af500.pdf?index=true
    • https://1923692e-f727-4f58-80a8-3583160180e3.filesusr.com/ugd/c4ccc4_8826f34658d54a1a96accb34a20f1ba8.pdf?index=true
    • https://f405dec1-7f90-4f4c-a861-5286f67d0127.filesusr.com/ugd/ab922d_e4755b2fc1344e9ebcc48258b135d02f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cfabc09d-8985-4ce2-a889-bbe7a8fa5469/panasonic_cordless_phone_kx-tge233b.pdf
    • https://uploads.strikinglycdn.com/files/bd273c1c-d90f-44f2-9169-7271547565ad/39336086689.pdf
    • https://uploads.strikinglycdn.com/files/d890cacb-acdc-4630-9a04-1354758efddc/76504691279.pdf
    • https://2987c0f4-171e-4473-b3f1-a5468658115b.filesusr.com/ugd/75ff8a_9034ffb8deb84110b60822cfcec7fdb4.pdf?index=true
    • http://bapinusajix.rf.gd/difference_between_alpha_helix_and_beta_sheet.pdf
    • https://uploads.strikinglycdn.com/files/b1f755b7-3c2d-4b16-8e42-a1e7f904808d/tibunejagatemo.pdf
    • https://8f1c0ae7-1ba6-4c51-a623-4d29f5e3aebb.filesusr.com/ugd/c1615c_f9a221bf5ba4410d99348d49484b9914.pdf?index=true
    • https://436010f1-0dd7-4950-aec0-3bdf337573e8.filesusr.com/ugd/5a4c69_e117255b44e44af18774ed37c769c7f8.pdf?index=true
    • https://ca108e69-7b6b-43f0-8f16-d96ebeb8a33d.filesusr.com/ugd/79e0dc_8b66e921dba14ebdb6944ccbbd09cb08.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3cb.bin
43c807b35c23d39a71cebf5b0c746a69a99ab9877caa82242e2d7e75f7951c28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3CB 5016 bytes
font_01_sfnt_off000104ff.bin
a0fed147930eff41c427151b27d9158d171a34f15fda8a3b368260fdca21148e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104FF 10512 bytes
font_02_sfnt_off00012904.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12904 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.