Malicious PDF — malware analysis report

Static analysis result for SHA-256 f22a9be12caef241…

MALICIOUS

PDF

72.9 KB Created: 2021-06-11 01:43:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ea983e07eb5db4ac316ef08b9c6836d SHA-1: c5bb5a59a2dbb1051af9659abd53e7ef3994e442 SHA-256: f22a9be12caef241f095288152042b87f28998364d0f2353a8c1a69632351318
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are dynamically generated and appear to be part of a link farm designed to obscure malicious intent. The ClamAV detection and ML classifier strongly indicate malicious content, likely a phishing or malware distribution lure. The document body, though heavily obfuscated, suggests a theme of 'Songs in tamil old' to entice clicks on the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/pbw?utm_term=songs+in+tamil+old
    • https://tozuriko.weebly.com/uploads/1/3/1/4/131437247/mulusekaket-gadad-wavimene.pdf
    • https://pafetuvuwube.weebly.com/uploads/1/3/4/3/134321561/vuxisi-wevitatefax-kipojuvadupari-bizuga.pdf
    • https://cdn-cms.f-static.net/uploads/4475383/normal_601f259572b33.pdf
    • https://cdn-cms.f-static.net/uploads/4402745/normal_60bd5bf21b410.pdf
    • https://static.s123-cdn-static.com/uploads/4382186/normal_5fce90caa94ba.pdf
    • https://xonuvalax.weebly.com/uploads/1/3/1/4/131437330/vusewezasuk.pdf
    • https://static.s123-cdn-static.com/uploads/4387928/normal_5fc59a4250785.pdf
    • https://xuvojumabu.weebly.com/uploads/1/3/6/0/136082507/faraxusulotoxosa.pdf
    • https://varijamali.weebly.com/uploads/1/3/1/8/131856150/vanowizupoz.pdf
    • https://cdn-cms.f-static.net/uploads/4406169/normal_600de9fbb2da0.pdf
    • https://fiduwovizeget.weebly.com/uploads/1/3/4/5/134517619/152a82cd18d5a19.pdf
    • https://static.s123-cdn-static.com/uploads/4383170/normal_5fcf090373250.pdf
    • https://cdn-cms.f-static.net/uploads/4408583/normal_6035b56702e99.pdf
    • https://xukokamil.weebly.com/uploads/1/3/4/3/134317204/a3726aaeb2c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b1b27e73-69c0-475e-8054-f668406b82e3/is_the_book_beautiful_disaster_a_movie.pdf
    • https://uploads.strikinglycdn.com/files/e58bf621-7f00-4513-b97c-01f52d7ea809/how_intel_keeps_stephen_hawking_talking.pdf
    • https://uploads.strikinglycdn.com/files/602e21f0-5e85-48b1-8b96-dbde095ca3f9/80156995048.pdf
    • https://uploads.strikinglycdn.com/files/e67f9d77-c096-4710-b5d2-b8bfa7c412c7/como_graficar_funciones_trigonometricas_tangente.pdf
    • http://pitavumiza.pbworks.com/f/how_do_i_write_a_letter_to_a_debt_collector.pdf
    • https://uploads.strikinglycdn.com/files/fb515d77-4e8c-4957-9c8e-07cba0510c69/39007577493.pdf
    • http://mevuteled.pbworks.com/w/file/fetch/144617841/62935269129.pdf
    • http://ganosidil.pbworks.com/w/file/fetch/144456651/how_to_pass_road_test_bc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e035.bin
7846b6e95547c1063753c53a66fa04bdcd759f13deb1014e4e7ead1af2b348aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE035 5152 bytes
font_01_sfnt_off0000f1ab.bin
3e8b2541ffade28a8f1f995028cf1d3f9372bf5f76beaf7c235f1754561ce98e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1AB 10804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.