Malicious PDF — malware analysis report

Static analysis result for SHA-256 f14d2ad3d5edee9a…

MALICIOUS

PDF

77.3 KB Created: 2021-03-29 08:58:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 843f4e6fc12a5b7da6e280fc493da4c5 SHA-1: dd3bc2e8396dbe97171a46de83061238df901e51 SHA-256: f14d2ad3d5edee9ae276a2f2c8ead641c2d58beb8192d7335f3e8b221cd3794d
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded JavaScript and a large number of external links, many of which are SEO-optimized and point to potentially malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, suggesting a link farm or redirection scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to phishing or malware download sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=bovarismo+brasileiro+maria+rita+kehl+pdf
    • http://bio-ita.fun/jotawipugesenufo99mkd.pdf
    • https://cdn.sqhk.co/kafekogi/gfgcmii/galaxy_attack_alien_shooter_level_24.pdf
    • https://cdn.sqhk.co/rugofufol/x0GVNhf/4_pics_1_word_6_letters_daily_challenge.pdf
    • http://nutetuxiv.mygamesonline.org/basic_english_grammar_book_3_saddleback.pdf
    • http://dabosesavedevet.medianewsonline.com/petronas_twin_towers_case_study.pdf
    • http://woziwowariv.sportsontheweb.net/catabolism_of_amino_acids.pdf
    • http://tideboweped.medianewsonline.com/29536118801.pdf
    • https://cdn.sqhk.co/sizebadit/Sjijhhd/41492568263.pdf
    • http://gamukanemafutu.mywebcommunity.org/wim_hof_method_breathing_explained.pdf
    • https://cdn.sqhk.co/liminekaj/cFht3ic/mazemilitia_lan_online_multiplayer_shooting_game.pdf
    • http://blancer.xyz/nurimowemuzn0bl4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jenisozazewubo/faasoft_video_converter_crack.pdf
    • https://s3.amazonaws.com/lawakux/applications_of_mathematics_in_daily_life.pdf
    • https://s3.amazonaws.com/zodererezuzuxi/romajexojomepo.pdf
    • https://0df6220b-9630-4647-aab6-0d9db69b9d59.filesusr.com/ugd/8b97dd_15c3fcc3bed140cea78d6ffb3bae99d3.pdf?index=true
    • https://1d812fcc-cfc3-4558-a870-56fc5b7f4c2e.filesusr.com/ugd/754d94_556f425f9fda4d70a87b32910ab89004.pdf?index=true
    • https://78905da9-dd21-4190-abaa-c894c042e703.filesusr.com/ugd/851c7c_5433970448c1441cb50af6c162829f3e.pdf?index=true
    • https://s3.amazonaws.com/nagudo/active_learning_method.pdf
    • https://fdf0fb27-5181-4190-8e1a-80fb86d87eb1.filesusr.com/ugd/2410c9_4e0e79549b354aef9cf912b6571431d8.pdf?index=true
    • https://s3.amazonaws.com/vebenok/wakudajezutedid.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edfa.bin
3640b4d407c4ffa742d98d8739902ea659abe37ae756a43d398a755747d3dc28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDFA 5596 bytes
font_01_sfnt_off000100d9.bin
bdf2185be818c9fe75252fb111ab3b1da93aefe69501031536b777161f35c128		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100D9 12860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.