Malicious PDF — malware analysis report

Static analysis result for SHA-256 f933a61fb1bedf7d…

MALICIOUS

PDF

76.5 KB Created: 2021-06-07 20:48:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2f15d95dca3670fa4828941d03db88eb SHA-1: 2db84d52d1fd4566e233e596dc04d5cf1135d5fd SHA-256: f933a61fb1bedf7de64e52d5030efeeb4720455940299832b58b5175072d2316
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier with high confidence. It contains a large number of external links, many of which point to PDF files, suggesting a link farm or SEO poisoning tactic. One of the primary external links, https://crewmak.ru/pbw?utm_term=calendario+lunar+para+siembra+2020+pdf, likely leads to a phishing or malware distribution site. No scripts were extracted, but the PDF structure and numerous external links indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=calendario+lunar+para+siembra+2020+pdf
    • https://static.s123-cdn-static.com/uploads/4474462/normal_5ff35cc22ff92.pdf
    • https://cdn-cms.f-static.net/uploads/4444869/normal_60648a3fd3d61.pdf
    • https://cdn-cms.f-static.net/uploads/4384030/normal_60238087a201d.pdf
    • https://static.s123-cdn-static.com/uploads/4488810/normal_5fc84981ea31a.pdf
    • https://tawatoxox.weebly.com/uploads/1/3/4/0/134018263/zatovolaref.pdf
    • https://xasigevas.weebly.com/uploads/1/3/4/5/134595911/fc97031346ab2f.pdf
    • https://static.s123-cdn-static.com/uploads/4423427/normal_600655153147c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jabevexizoj.pbworks.com/w/file/fetch/144777321/how_to_clean_my_little_steamer_go_mini.pdf
    • https://uploads.strikinglycdn.com/files/7bb10932-2928-48b5-92e0-bde8ac8cba2d/tonuwefazux.pdf
    • https://uploads.strikinglycdn.com/files/a6063ef2-2c00-458f-aab3-3d478f9480ab/ejemplo_de_evaluacin_diagnostica_para_segundo_grado_de_preescolar.pdf
    • https://uploads.strikinglycdn.com/files/bc1ad573-4647-4ea1-a3de-4fa14e1c447d/68805964278.pdf
    • https://uploads.strikinglycdn.com/files/b1f8e8e7-8aa3-464a-ae32-eff190b887e2/16211689510.pdf
    • https://uploads.strikinglycdn.com/files/80fd2693-737f-4db1-8fbe-9d66e520029c/what_is_strengths_based_perspective_in_social_work.pdf
    • https://uploads.strikinglycdn.com/files/1c2fc204-4152-4228-b8e0-13fd21d80b18/how_to_fix_furnace_gas_valve.pdf
    • https://uploads.strikinglycdn.com/files/ff2d6d14-6983-4a81-9c91-f73be2824ed2/panasonic_dmc-zs40_charging_cable.pdf
    • http://pilujibos.pbworks.com/w/file/fetch/144565815/69247287728.pdf
    • https://uploads.strikinglycdn.com/files/eacccd14-e433-473f-9524-148f4d821df5/download_docker_desktop_for_windows_7_32_bit.pdf
    • http://ruwomodanom.pbworks.com/f/how_do_i_connect_my_bose_bluetooth_speaker_to_alexa.pdf
    • http://zuwuzemoj.pbworks.com/f/28282458552.pdf
    • http://wimarolos.pbworks.com/w/file/fetch/144509547/pencil_drawing_techniques_easy_sketching_book_for_beginners.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eabe.bin
884e9c379ace260275ab43ab87bd8138ec66e1b9bf32879eca40c16402d27f6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEABE 5508 bytes
font_01_sfnt_off0000fd51.bin
dd434e1fca3c019c219400b484c5ef90fd1af9226085aebf192d2d4cbf8d8e65		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD51 11396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.