Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecd0bb28f880b571…

MALICIOUS

PDF

88.5 KB Created: 2021-03-22 14:39:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b63390f728fac116ed02c3fa7f92123d SHA-1: 7cfc9f44e01839331c56f842d99b40af4d1a7165 SHA-256: ecd0bb28f880b5716e9de329d0d6a2b93596b2179920685fab24c601d520e374
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a technique often used for SEO farms or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' and the presence of the URL 'https://midufefew.ru/wix?keyword=contagious+pdf+drive' strongly suggest a malicious intent to drive traffic or phish users. ClamAV also detected this file as 'Pdf.Phishing.Trojan'. No scripts were extracted, but the document structure itself indicates a malicious purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=contagious+pdf+drive
    • https://labajilawuja.weebly.com/uploads/1/3/1/4/131406369/9857403.pdf
    • https://bawejitomu.weebly.com/uploads/1/3/1/4/131438353/b4f83a63d0ba3.pdf
    • https://folugaso.weebly.com/uploads/1/3/4/5/134503816/mudijurawurumu_vuxisazofixela_dixibovarome_duverinevumodot.pdf
    • https://kaxorude.weebly.com/uploads/1/3/4/0/134095875/d6220cec7740198.pdf
    • http://muvibigi.22web.org/zuwalatafus.pdf
    • https://voxesisa.weebly.com/uploads/1/3/4/3/134349259/kopuxododudad.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9589f389-f5a8-4f8f-b885-44240c4d0ae1/91004036096.pdf
    • https://uploads.strikinglycdn.com/files/1305c827-e4df-4c15-8ba4-e424404cc586/ketarakapave.pdf
    • https://s3.amazonaws.com/popisiburewixuj/matlab_plot_points_with_vertical_lines.pdf
    • http://mifepotuguw.rf.gd/jigidijuravumituwu.pdf
    • https://s3.amazonaws.com/rilexazejuzovep/farowibaxonexafiratafap.pdf
    • https://s3.amazonaws.com/lebaxa/king_size_bed_sheet_in_cm.pdf
    • https://s3.amazonaws.com/jarawaxanivu/editable_receipt_template_excel.pdf
    • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_5336e74778634bb893063b09165ead28.pdf?index=true
    • https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_78ea9020081a40ed8d4e9ff427fe1e27.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bf0cce75-7054-4aa1-8747-f283b5b0a4bc/69219404443.pdf
    • http://lubelulezafi.rf.gd/bagapetuwiludokuvuf.pdf
    • https://uploads.strikinglycdn.com/files/9ec7b6f8-7a17-4c26-b13f-84a34fac3e95/xuriduxelile.pdf
    • https://uploads.strikinglycdn.com/files/c2d8c32e-7202-4d05-b9cb-2ff7f0705517/how_to_learn_html_and_css_quickly.pdf
    • https://uploads.strikinglycdn.com/files/b9aeacb6-5c42-4878-b4d2-ac7fdda1cb08/overlord_vol_4_light_novel_hardcover.pdf
    • https://s3.amazonaws.com/resixexi/philippine_long_distance_telephone_company_annual_report.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011edc.bin
b76f2f3efb09fb6a526de2a1933537ba012265aded160a298d5d6f4424141ab2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11EDC 5140 bytes
font_01_sfnt_off00013071.bin
3ef52c2aad19a2a897e4418052b90032619b8bb9229f76c94fb29ac25d35e22f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13071 10788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.