Malicious PDF — malware analysis report

Static analysis result for SHA-256 f47b5c37244d438c…

MALICIOUS

PDF

80.6 KB Created: 2021-03-29 05:56:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: f345d4ab4de9e929d14320dab7734e56 SHA-1: 38fd6f1034b0775b5a53774fec8d13b025f64a87 SHA-256: f47b5c37244d438c7e067dcdf663afe31a521e55e22478a87d38c045bf2e1400
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO poisoning attempt. The ML classifier and ClamAV detection strongly indicate maliciousness, with ClamAV identifying it as a phishing trojan. The embedded URLs are likely used to redirect users to malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=annapurna+circuit+map+pdf PDF link annotation
    • http://bozabanafuz.22web.org/1494321981.pdfIn PDF document text
    • https://vagobodowi.weebly.com/uploads/1/3/4/6/134600101/nenet-fufalagum.pdfIn PDF document text
    • http://dikagowoxi.sportsontheweb.net/abscesso_cerebral.pdfIn PDF document text
    • https://jodisugej.weebly.com/uploads/1/3/4/7/134732418/4021992.pdfIn PDF document text
    • https://susetizumuru.weebly.com/uploads/1/3/4/4/134461935/33872c62.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4427544/normal_5ffcd1e9caafc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501989/normal_5fd7872e6f5b9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/midaguvimabof/bolsa_chica_surf_report_magicseaweed.pdfIn PDF document text
    • http://zirafefovijab.epizy.com/vowepilapowejodazumum.pdfIn PDF document text
    • https://s3.amazonaws.com/xuzed/depadimixo.pdfIn PDF document text
    • https://76a725e8-946c-4ae9-9249-cda469d35108.filesusr.com/ugd/83c8cc_c84e41afeb5b4e24b2b432ceaedbae09.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/palevijuj/wodamokowaziposal.pdfIn PDF document text
    • http://zitasixan.atwebpages.com/62863108557.pdfIn PDF document text
    • https://s3.amazonaws.com/wozowuledij/50350017078.pdfIn PDF document text
    • https://b6d28218-96ba-4f98-b9c1-0d78b4e6fe84.filesusr.com/ugd/47aa88_3441663a088d4350a964a72ff5a01992.pdf?index=trueIn PDF document text
    • http://pulitisagot.atwebpages.com/esv_study_bible_version.pdfIn PDF document text
    • https://5e9816b5-e261-4a84-a5c7-594b6999e1c8.filesusr.com/ugd/eb2f7d_88a0a1a02e324d30b76b4a7253687e67.pdf?index=trueIn PDF document text
    • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_1f9e8f3d31784c1ead2eb294bccd5bf0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dezajok/what_type_of_reaction_is_n2_g_3h2_g_2nh3_g.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f550.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF550 4736 bytes
SHA-256: 2fd42688a641c2264b8bed93d142a84878ca6e6979ca35f5359a91fc1de55f3f
font_01_sfnt_off0001053f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1053F 9884 bytes
SHA-256: 3c26f25d4613e49dc6c31109236a3f94398567d59f5b6511e49fa181d4e9de2c
font_02_sfnt_off0001271b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1271B 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.