Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9d0689b45992985…

MALICIOUS

PDF

81.2 KB Created: 2021-03-14 22:44:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6152edb1c07952865f816071f0ef5230 SHA-1: b24a00b847a2eb4d73619bbb254914db44091ad5 SHA-256: e9d0689b45992985f58521d71d4ceb47da615f437e798905d3dfc7b275fd9542
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDF files, suggesting a link farm or redirection mechanism. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. The document's content, though garbled, appears to be a lure for software, which is a common tactic for distributing malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=logo+creator+software+for+windows+10
    • http://lojapidabud.mypressonline.com/68697057977.pdf
    • https://fixemebipufuw.weebly.com/uploads/1/3/4/1/134131586/d3a713929fbb738.pdf
    • https://static.s123-cdn-static.com/uploads/4393901/normal_5fcc8d9e0ab16.pdf
    • https://static.s123-cdn-static.com/uploads/4458616/normal_5fd04ec19bd56.pdf
    • https://static.s123-cdn-static.com/uploads/4393911/normal_5ff8b21a2308f.pdf
    • https://static.s123-cdn-static.com/uploads/4389353/normal_5fd0481d32b00.pdf
    • https://cdn-cms.f-static.net/uploads/4487413/normal_60249721943de.pdf
    • http://rokuboxajiga.medianewsonline.com/18035603861.pdf
    • https://zitozujenuzudip.weebly.com/uploads/1/3/4/0/134042901/79bffd15e5.pdf
    • https://static.s123-cdn-static.com/uploads/4465252/normal_6008f34c748a8.pdf
    • https://tekevifumufov.weebly.com/uploads/1/3/0/7/130739519/3d3bba34db.pdf
    • https://cdn-cms.f-static.net/uploads/4479441/normal_5fea36a6ba6d9.pdf
    • https://cdn-cms.f-static.net/uploads/4414672/normal_601e82f12362d.pdf
    • https://cdn-cms.f-static.net/uploads/4411937/normal_603ff9817dc55.pdf
    • http://jijuduli.mywebcommunity.org/piledu.pdf
    • https://cdn-cms.f-static.net/uploads/4470016/normal_5fdab01bccb00.pdf
    • https://cdn-cms.f-static.net/uploads/4366008/normal_60180b4ca1033.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://3176e400-c268-4dc0-8d69-08eae86937f8.filesusr.com/ugd/ea2f88_5da923101e44421fbef8aa6c0955de6a.pdf?index=true
    • https://3c8197b3-f999-4f29-b3da-fbdfea3dbf34.filesusr.com/ugd/0047a4_75b3a230fa944f01b249af7a7e49fe40.pdf?index=true
    • https://74269c25-1731-4359-90d4-804f54ef9c1c.filesusr.com/ugd/b5973a_435ea4fa936b476fa160f251b61b42e8.pdf?index=true
    • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_bf60e76a6019426094a57337917efcb8.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f224.bin
b0790b8ff332b6a4fd27f031d356360ca2b9c8afaa3201d954d8e25cf77b7697		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF224 5172 bytes
font_01_sfnt_off000103dc.bin
d26dc7899f326ed60c7a7ce6d6e6075ff6f6c74f71c589986ac09bfd62d3f7d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103DC 10908 bytes
font_02_sfnt_off00012908.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12908 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.