Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc00d13700cd9f75…

MALICIOUS

PDF

77.8 KB Created: 2021-03-29 00:08:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 435cb37b0a474fd0818560f68c4f962d SHA-1: ceb2aff920bec177f6d86a5bc698b6469c4efea3 SHA-256: fc00d13700cd9f7517bb900b2b2e726c6f9738ad9528ebf75f9002530fadb225
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on Weebly, suggesting a link farm or phishing campaign. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=pac+pdf+accessibility+checker+2.+0
    • https://gegoviboz.weebly.com/uploads/1/3/4/8/134876631/c837ffbeb3cda41.pdf
    • https://fejoburu.weebly.com/uploads/1/3/0/8/130813906/8b2f66.pdf
    • https://static.s123-cdn-static.com/uploads/4379722/normal_5ff37827d30bc.pdf
    • https://xesaranit.weebly.com/uploads/1/3/2/6/132696194/8953250.pdf
    • https://static.s123-cdn-static.com/uploads/4458132/normal_600362ee9adf3.pdf
    • https://diwodineguxep.weebly.com/uploads/1/3/4/3/134305573/1135148.pdf
    • https://nakotugobal.weebly.com/uploads/1/3/5/3/135300729/f2ec4a25.pdf
    • https://mevukufidax.weebly.com/uploads/1/3/1/3/131379039/7361876.pdf
    • http://fogebepe.22web.org/73704883823.pdf
    • https://xezazevexu.weebly.com/uploads/1/3/5/9/135990031/7b8cf919bac3922.pdf
    • https://dunegigamirusa.weebly.com/uploads/1/3/1/4/131437715/8755337.pdf
    • https://jumomemokipus.weebly.com/uploads/1/3/0/8/130874307/joxolade_rowegipat_fijavoxo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vavejijitatofu/rusomodofisetoxexipogoj.pdf
    • https://7fc1e5b2-1dd8-4457-9de2-3dea1ab9f589.filesusr.com/ugd/fedd61_b5f6429ffc17401593b5e117405d9392.pdf?index=true
    • https://s3.amazonaws.com/vipinib/selaxapuvirilizugijavef.pdf
    • http://kawetagomududu.rf.gd/why_is_spectrum_internet_not_connecting.pdf
    • https://s3.amazonaws.com/jokotaziweluge/gekonifurorakaxirepijit.pdf
    • https://288dffde-0386-48bd-adba-b069b5f3b70f.filesusr.com/ugd/7e1b39_fa43cb42b36e44b69cdae2a353b05ae8.pdf?index=true
    • https://s3.amazonaws.com/zodererezuzuxi/currys_essentials_fridge_freezer_manual.pdf
    • http://suwiwozeko.rf.gd/the_trials_of_apollo_review.pdf
    • https://c8d0f166-86fd-441b-8df5-aa5e6c6c7644.filesusr.com/ugd/f4b3af_50462154b814460781d9fbf17d81e60e.pdf?index=true
    • https://f7f2eb1f-4ce6-40bf-b337-6bcc2c9c1a95.filesusr.com/ugd/dc6899_334011eb084849e6b9ca17ed71f254ad.pdf?index=true
    • https://s3.amazonaws.com/palikuvexake/57816349205.pdf
    • http://pijularof.epizy.com/community_acquired_pneumonia_guidelines_2017_philippines.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f18d.bin
bbe2e15f8d86a7515f3b3ce95a02c9215c00f590c11c906d057efc9dd41cba0a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF18D 5856 bytes
font_01_sfnt_off0001057d.bin
8ca841b97977804abad6507025a4ce2c3714c611c6c501dc237eb7100d6967a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1057D 10532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.