Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbf4b75381faf47b…

MALICIOUS

PDF

61.2 KB Created: 2021-06-04 00:12:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b8f7fc58312d38c7d74bbbcb2a416837 SHA-1: c1621bcb1f7aa0917f1b7272399b271c9cecba77 SHA-256: fbf4b75381faf47b644520aaf36320668cdde9b7be3b68aea9b159b867d09ac6
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to other PDF files, suggesting a link farm or phishing campaign. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary URL, https://allytemp.ru/pbw?utm_term=merryweather+heist+tips, is likely used to redirect the user to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9693

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://allytemp.ru/pbw?utm_term=merryweather+heist+tips
    • https://cdn-cms.f-static.net/uploads/4451352/normal_606835f9dd08a.pdf
    • https://jisiresofuwidi.weebly.com/uploads/1/3/0/7/130739297/1bbc7.pdf
    • https://cdn-cms.f-static.net/uploads/4419846/normal_603e4e8535422.pdf
    • https://xafokevixutevib.weebly.com/uploads/1/3/2/6/132681308/7684127.pdf
    • https://detalejutapebis.weebly.com/uploads/1/3/4/6/134610814/5610866.pdf
    • https://static.s123-cdn-static.com/uploads/4485813/normal_60033df5d2eb1.pdf
    • https://static.s123-cdn-static.com/uploads/4466408/normal_5fe1cdd36f5a3.pdf
    • https://larulesa.weebly.com/uploads/1/3/4/7/134717423/1244869.pdf
    • https://cdn-cms.f-static.net/uploads/4451930/normal_60234c8562f8a.pdf
    • https://static.s123-cdn-static.com/uploads/4455208/normal_5fde935e48862.pdf
    • https://cdn-cms.f-static.net/uploads/4444378/normal_604d723d48473.pdf
    • https://kebufuwotum.weebly.com/uploads/1/3/4/0/134040355/4806581.pdf
    • https://cdn-cms.f-static.net/uploads/4425255/normal_60552c674f62f.pdf
    • https://rusipowesurajuk.weebly.com/uploads/1/3/4/5/134520473/c917fa13609e970.pdf
    • https://cdn-cms.f-static.net/uploads/4467573/normal_606cae15610e1.pdf
    • https://finoritibad.weebly.com/uploads/1/3/4/4/134468058/7016465.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xelivolofuso.pbworks.com/w/file/fetch/144540849/rokuj.pdf
    • http://kemuxin.pbworks.com/f/mini_militia_2020_mod_apk_unlimited_money.pdf
    • http://kafunujazuwo.pbworks.com/w/file/fetch/144577860/gadenuf.pdf
    • http://pokuwatosat.pbworks.com/w/file/fetch/144556722/mufipodapomitufov.pdf
    • http://jitijaloj.pbworks.com/w/file/fetch/144566019/38094470320.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da70.bin
cff205c66697a3005894dca7e2193ee02a51fa0174547df96c5d9b9345f7609e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA70 5072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.