Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec4e7b9310c980a0…

MALICIOUS

PDF

72.5 KB Created: 2021-06-13 13:01:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 268a67260a6e69d09d7d6f36cdb9449d SHA-1: c8d51191f2bb57bfa52686f337740b25f4a79f58 SHA-256: ec4e7b9310c980a0eaa969086bd1fe27655b49bd26f8c5eb8d71f1bb0f3b9c3b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to other PDFs, suggesting a link farm or SEO manipulation tactic. One of the embedded URLs, 'https://infrive.ru/pbw?utm_term=python+create+new+column+based+on+other+columns', is flagged as unknown reputation and is likely the primary malicious destination. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=python+create+new+column+based+on+other+columns
    • https://static.s123-cdn-static.com/uploads/4479678/normal_600913f0a78aa.pdf
    • https://static.s123-cdn-static.com/uploads/4409997/normal_6000060ca9089.pdf
    • https://vakikuxikedeti.weebly.com/uploads/1/3/5/3/135320305/c7698a169e08397.pdf
    • https://cdn-cms.f-static.net/uploads/4368954/normal_6032385816f57.pdf
    • https://cdn-cms.f-static.net/uploads/4381528/normal_60b9289240f63.pdf
    • https://junetinovifadi.weebly.com/uploads/1/3/0/9/130968968/fujefalapi_nukoberif.pdf
    • https://static.s123-cdn-static.com/uploads/4374520/normal_60067edf0f140.pdf
    • https://static.s123-cdn-static.com/uploads/4493282/normal_6006055269e1e.pdf
    • https://fesulupomoguza.weebly.com/uploads/1/3/7/5/137519026/kebikaleg_wunoji.pdf
    • https://cdn-cms.f-static.net/uploads/4447096/normal_604698f24e157.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/415c19b1-406e-49c8-9448-9beaeea2dedf/pujejixegesimenizome.pdf
    • https://uploads.strikinglycdn.com/files/b7b09cde-12a2-4b44-8273-1d6465cd908c/eye_of_the_beholder_movie_meaning.pdf
    • https://uploads.strikinglycdn.com/files/34207381-b546-4e7f-961c-e70c7186ce67/divisiones_de_2_cifras_exactas_resueltas.pdf
    • https://uploads.strikinglycdn.com/files/c1dd5984-a397-4355-a2fd-0e27a0f9c698/whatsapp_business_for_pc_free_download.pdf
    • http://bolejagum.pbworks.com/w/file/fetch/145183785/97771195506.pdf
    • https://uploads.strikinglycdn.com/files/4937401f-6bfa-4513-ae08-4223ac465b6f/data_structures_in_c_by_seymour_lipschutz_free_download.pdf
    • http://mifudatu.pbworks.com/f/30666549488.pdf
    • https://uploads.strikinglycdn.com/files/e11bd41c-612a-4e48-b958-7767a573597f/too_big_to_fail.pdf
    • https://uploads.strikinglycdn.com/files/000c0ef3-9bfe-4667-b713-ae10d9feaee0/how_to_clean_out_a_cool_mist_humidifier.pdf
    • http://wipadewor.pbworks.com/w/file/fetch/144992418/luvamunazuxekazibar.pdf
    • http://gupiguna.pbworks.com/w/file/fetch/144805914/38226408815.pdf
    • https://uploads.strikinglycdn.com/files/93b6bad5-27ae-4469-bd8f-207c73968831/factorytalk_view_historian_se_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbd3.bin
2c99024c585ad4f70d4d23789b3ee05237043a9dff44e69834915036acc109a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBD3 5512 bytes
font_01_sfnt_off0000ee78.bin
917be12e321fe0ecc69e5148467c94d450f04b383b662853f0d45fe0a3485641		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE78 11092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.