Malicious PDF — malware analysis report

Static analysis result for SHA-256 f89c66c851445f01…

MALICIOUS

PDF

82.8 KB Created: 2021-03-26 18:01:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 176edb340239a6d2bc88568f88e7432b SHA-1: 2404d3d7566bc0905b97ebd6ff78f99317162353 SHA-256: f89c66c851445f01a609bd74ef2087185eecc55014cb7aa5578e95c1f9cac714
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a technique often used in link farms to manipulate search engine rankings or redirect users to malicious sites. ClamAV and ML classifiers identified this PDF as malicious, specifically a phishing trojan. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=maidenform+panty+size+guide
    • http://juvugewit.iblogger.org/56140144974.pdf
    • https://tupeduwexawagov.weebly.com/uploads/1/3/1/6/131607208/144eddd.pdf
    • http://mastericy-chistoty.ru/beruxesogelumifimom9d6ba.pdf
    • http://health-top.ru/mimpi_hamil_anak_kembar_5iztzi.pdf
    • https://vomuzubedabop.weebly.com/uploads/1/3/0/9/130969103/3d61a933853e51.pdf
    • http://vupofapotonez.22web.org/vitofavonapofetimubog.pdf
    • http://xaduwojitodefo.66ghz.com/bba_full_form_tamil.pdf
    • http://7gusevshop.space/dictionary_of_literary_terms_and_literary_theorypgagz.pdf
    • https://pavonaxasove.weebly.com/uploads/1/3/5/3/135310158/92a1ef89f3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1725cc60-d06d-4651-86e6-a256653013ff/senior_operations_manager_salary_philippines_per_month.pdf
    • https://uploads.strikinglycdn.com/files/1c2d4fd6-f777-412c-ad16-71ce4af11556/fuvirosun.pdf
    • https://uploads.strikinglycdn.com/files/458ca9b7-7783-4f23-874d-8049890c88dc/how_to_fight_with_a_kukri_knife.pdf
    • https://uploads.strikinglycdn.com/files/c9757979-4d6d-42d5-a4ef-119623438636/how_much_does_a_sony_wega_36_tv_weight.pdf
    • https://uploads.strikinglycdn.com/files/c516b108-1b25-4e5c-86a0-2b2c1d393c28/speaking_up_without_freaking_out_free_download.pdf
    • https://uploads.strikinglycdn.com/files/35f07391-b8e2-4e90-ac04-c5a4610003d2/blank_emotion_wheel_printable.pdf
    • https://uploads.strikinglycdn.com/files/c387bb4e-6740-4191-bb6c-ec65ea8f01f1/how_much_does_an_electrical_maintenance_technician_make.pdf
    • https://uploads.strikinglycdn.com/files/2e9d5bb5-d511-4845-a2fa-add45e9dad55/ragudopotivixirebidoxubo.pdf
    • https://uploads.strikinglycdn.com/files/d36b4a1e-2ddf-48df-b376-1e19dbdda2c8/ruzuwojomejaj.pdf
    • https://uploads.strikinglycdn.com/files/d9e41f84-904f-4562-b4c0-c9b61007bbce/pressure_washer_pump_parts_troy_bilt.pdf
    • https://uploads.strikinglycdn.com/files/cc8a2ac9-9590-4366-8dc0-c6e7a26d33a2/95381442873.pdf
    • https://uploads.strikinglycdn.com/files/1a563601-167a-44ed-9d46-5eaf1e9fedc0/panasonic_cordless_phone_answer_machine.pdf
    • https://uploads.strikinglycdn.com/files/2672bdf6-02c5-4015-abb3-8d344bc5cb92/58987523654.pdf
    • http://jowelipap.epizy.com/juxovumumafovukina.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010723.bin
a66cf4bd441eccebe5276b68abe611c74a4a43a643df9ba7d561b30d7e582fd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10723 5488 bytes
font_01_sfnt_off000119d9.bin
88ef3bd81caab25daf21aad9873717623be8df4a27a6c2c96dbe90679622806b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119D9 10508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.