Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3b1dce1cd120c19…

MALICIOUS

PDF

95.3 KB Created: 2021-03-31 00:04:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: c38aeefb7e06fb1948a2ca448b767366 SHA-1: 142e2a3c720d4c2208f52ca0d8f3f911414e5017 SHA-256: f3b1dce1cd120c19ffa3878a374f3e012d6471d6af0b2395ac0a98ce0f3da5d2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=h%25E1%25BB%258Dc+ch%25C3%25BA+l%25C4%2583ng+nghi%25C3%25AAm+ti%25E1%25BA%25BFng+ph%25E1%25BA%25A1n PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_41faf87e579d45eaae78e6ae45ed73af.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kitakilesa/lowrance_hook_5_hdi_depth_finder.pdfIn PDF document text
    • https://b3dfd9c9-1030-471f-a26d-814ea73dbccc.filesusr.com/ugd/d97afa_6923c7ea61214288824fe67012190c45.pdf?index=trueIn PDF document text
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_96f79048692f46769cd51eb49494ad35.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b484eb56-ef8e-4f19-a081-74005a7f3cfc/what_is_agile_cycle_time.pdfIn PDF document text
    • https://s3.amazonaws.com/sonutopexaramuf/cbre_group_inc._s_annual_report.pdfIn PDF document text
    • https://s3.amazonaws.com/bejenosugede/human_brain_powerpoint_template_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/543b6e60-25cb-4a4f-bdc2-7c58440fe2e0/the_chocolate_touch_book_free.pdfIn PDF document text
    • https://0306adf0-382e-42f1-903d-71c3961c97f1.filesusr.com/ugd/7ff653_6c00a8e19d7948bcb000bc8792e0ffbf.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e3f0a15-c101-4355-b0f8-6f3de5ebc2e0/ford_6.0_diesel_fuel_system_diagram.pdfIn PDF document text
    • https://5634f520-c25d-421d-ab67-3d94505d13cb.filesusr.com/ugd/1b85ab_d5cc0de47136473ea2cbb4e6c33ae3e5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/565e5270-832f-4bb6-83e3-1a74e7c5819b/parts_diagram_for_briggs_and_stratton_engine.pdfIn PDF document text
    • https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_a7ff5c26449d46f982be6505cbe64cec.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xomepixo/formato_de_portada_de_tesis_en_word.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b60dbb4-6824-4d1e-b553-a32b41f2e17f/40890470604.pdfIn PDF document text
    • https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_2f643c2548464df29a15d0a708acf2ca.pdf?index=trueIn PDF document text
    • https://eed7fa7e-4f31-4ba6-8269-e73f07ac74c5.filesusr.com/ugd/93374d_6794fe7051034edb9135a358aeee5363.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juvetaso/rusosiniderakunomaxut.pdfIn PDF document text
    • https://s3.amazonaws.com/vuterijoze/cambridge_book_9_listening_test_2_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7bf05d77-d243-4f6a-8bef-d848b40936f2/bowajax.pdfIn PDF document text
    • https://5c09c65f-4728-49e3-9562-8692e696fc4f.filesusr.com/ugd/32acb1_550ab00661c44f3dabe47e32ac3e910e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dosalapasenow/what_is_a_good_sat_score_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/lopadivupudexa/85730437159.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/inquest_reports_online_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82dd30a7-c5fd-4f42-a63b-6f28c445b931/ideas_for_christmas_table_favours.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001083d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1083D 7764 bytes
SHA-256: 6f7ab9132d712cd1f40d42ab3382c866a7afe3b9086831e3299929eb813d1789
font_01_sfnt_off00012235.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12235 5876 bytes
SHA-256: 996d306eef6f7879f2a14668f1d6522c4ad8687e7deb21de51451d4adf749450
font_02_sfnt_off0001346e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1346E 26524 bytes
SHA-256: 031e73a2fdfb1009c068f51ae000a99aabfcf36f382c61d4b9d8c3248480afdf