Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0bc1eeb4db2a7a4…

MALICIOUS

PDF

85.5 KB Created: 2021-03-18 08:33:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5714e86a3300294753f37a3d5256ff16 SHA-1: 95f38d7aeb11bba6eb44ae9dbdce0d84a9435700 SHA-256: f0bc1eeb4db2a7a49b5884fdc56638498612b46bca2c1d3e1912f08fadfc1db4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains a large number of external links, many of which point to other PDF files, suggesting a link farm or a distribution mechanism for further payloads. The document body, though heavily obfuscated, contains a search query related to 'female yorkie for sale', likely a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=female+yorkie+for+sale
    • http://wide-take.top/wosazobutinfd.pdf
    • http://tcerkovniekupola.space/porsche_944_rally_car7wbbl.pdf
    • https://lejawoxaniw.weebly.com/uploads/1/3/0/7/130738778/06878.pdf
    • http://app-3null.com/dipiro_pharmacotherapy_10th_editionm26gm.pdf
    • http://nonly.xyz/autocad_civil_3d_2016_training_manual3vxtd.pdf
    • https://xilarurizajefa.weebly.com/uploads/1/3/5/3/135347329/dijevilaz.pdf
    • http://clebohets.xyz/john_cage_lecture_on_nothing_audiowrzpo.pdf
    • https://nonokutofukidob.weebly.com/uploads/1/3/4/8/134872148/a9d5c.pdf
    • http://weinmvc.net/how_to_check_transmission_fluid_level_ford_ranger1ludu.pdf
    • https://sopetenoredu.weebly.com/uploads/1/3/5/3/135318191/3165030.pdf
    • https://maparezoja.weebly.com/uploads/1/3/5/3/135321508/92209c527.pdf
    • http://hookup671.site/calotropis_procera_morphology9xcwa.pdf
    • http://djami.ru/26059209008y9fxs.pdf
    • http://fitness1.space/sims_3_generations_challengeka50z.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sigobija/update_android_10_nokia_6._1_plus.pdf
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_105ad1c2055e48a681b2efd52f81301c.pdf?index=true
    • https://s3.amazonaws.com/vunizi/diguzifo.pdf
    • https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_22448914a79e4af1ae2374500d52f762.pdf?index=true
    • https://9cf93ecd-64ee-4ad6-afcc-f350577a7522.filesusr.com/ugd/c4dbd3_4d9da262c41a4b01a8a7f4b45f80b836.pdf?index=true
    • https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_b07d113eeae84806acde61e066dfc00c.pdf?index=true
    • https://354df738-7a8c-4643-bdcd-aa58f7c4bd0c.filesusr.com/ugd/69cf62_e6a7d7ab5b05415d92e62b4106cda52d.pdf?index=true
    • https://740e8036-3174-4dac-ae20-9eee1cd11a0a.filesusr.com/ugd/0f1c31_bdaa7e4ea48e4821a0a7063f0c79a840.pdf?index=true
    • https://s3.amazonaws.com/xukirizugukugi/how_to_do_vertical_gardening.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000111ba.bin
c7d857ec109dbe9e82c7a339b6ad4ee1582e0be036e707c3482f9d9797f1591f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111BA 5036 bytes
font_01_sfnt_off000122ce.bin
6bce219408dadf8a63f9c68f322c2484a54e0e0ddfb42f36000779175f6f9f48		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122CE 11140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.