Malicious PDF — malware analysis report

Static analysis result for SHA-256 f06dba7ae652a50f…

MALICIOUS

PDF

76.6 KB Created: 2021-03-16 13:10:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 69d6baebb3dafa9d34599385dc61b3d7 SHA-1: 96a7f3a0ac2ffe4a1f56514dadf67e208b9f38a3 SHA-256: f06dba7ae652a50f0d44068e0426666b1864f2d50e7a7ee7b6ab9cc74e8d1e59
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=cambridge+4+listening+test+2+pdf PDF link annotation
    • http://gromstroy.com/zafomunekavh60v.pdfIn PDF document text
    • http://savadaqwe.space/69017849093kkl1a.pdfIn PDF document text
    • http://repair-monokoles.ru/wopixeruxudi98o83.pdfIn PDF document text
    • http://5coupons.info/verb_tense_consistency_exercises1vtph.pdfIn PDF document text
    • http://hargotel.xyz/reloading_powder_shortage_2019kgdu9.pdfIn PDF document text
    • http://hempmap.ru/zodiac_robert_graysmith_book_reviewdcp0z.pdfIn PDF document text
    • http://gprofights.ru/how_do_you_reset_the_service_engine_soon_light_on_a_nissan_altimarykv6.pdfIn PDF document text
    • https://cdn.sqhk.co/pulazapusaw/OhisoNY/gesisubokitaxiniv.pdfIn PDF document text
    • http://devgm.design/indicators_of_potential_workplace_violence_answerm6tn0.pdfIn PDF document text
    • https://cdn.sqhk.co/tomibigi/cujey5H/15779762828.pdfIn PDF document text
    • https://cdn.sqhk.co/towinomer/e3jejiu/saladin_movie_cast.pdfIn PDF document text
    • http://lady-bug.club/nokia_mobile_game_snake_xenzia_cheat_codesp3kkh.pdfIn PDF document text
    • https://cdn.sqhk.co/mevazasid/hahg7ii/simple_music_player_for_dementia_canada.pdfIn PDF document text
    • https://cdn.sqhk.co/xuwadezab/nliipia/download_lep_s_world_3_mod_apk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://591e60e9-54e8-4b06-a9a7-f2e0522969d0.filesusr.com/ugd/1fd4b7_23f128df3eab4332ba3c432361f4a942.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/muvemasoxaji/free_event_planner_contract_word_template.pdfIn PDF document text
    • https://28481333-1ef2-46fb-8ebf-d56c3f24acbc.filesusr.com/ugd/314c35_b4bd6708cd524d81803c6f5954598223.pdf?index=trueIn PDF document text
    • https://9f53eded-325d-4e02-8430-7c09bd872488.filesusr.com/ugd/e04405_083b8e66b1f848b5b6d3573fe4ba5499.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wavunot/62098548340.pdfIn PDF document text
    • https://edefa294-c65c-46c5-840b-8a4669b9fdfe.filesusr.com/ugd/e4a001_82656306235148d890a94e072c7808b0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xakapudakadu/9981501936.pdfIn PDF document text
    • https://s3.amazonaws.com/rovikibixu/va_dmv_test_questions_and_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/mefonevimimix/71543810502.pdfIn PDF document text
    • https://s3.amazonaws.com/pizivurapab/naxejegugorajetaga.pdfIn PDF document text
    • https://s3.amazonaws.com/tupofelasujewas/lonely_planet_guidebooks_greece.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e11c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE11C 2884 bytes
SHA-256: 0cc67ea6a084524ba64ee4e0543816169088ed1b3fa13efd27044a36c0797e32
font_01_sfnt_off0000eb54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB54 5624 bytes
SHA-256: 8eec1e525ae5ec48320dcd5213b2f558d1eee3cde96f3412a02fe1128af66ddc
font_02_sfnt_off0000fe5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE5A 11072 bytes
SHA-256: 020e3af536bb96840333e81d211bccd435fe3fc1a193e66fd423321384996fdf

Open this report in the interactive analyzer, or submit your own file for analysis.