Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc1c0d49f2de7070…

MALICIOUS

PDF

80.5 KB Created: 2021-04-03 18:16:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 264b6dc84ea178ed79393fa7f6e5c4b6 SHA-1: 2683cc2cf234b82cf2cbf602b3076bde54de5c58 SHA-256: fc1c0d49f2de70705af3685ebcc26fa0dae3e8fe1ce868d78b4a1b8c556c6a32
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used for phishing or distributing further malware. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of links, suggesting a malicious intent to redirect users to potentially harmful sites. The ML classifier and ClamAV detection strongly indicate malicious content, likely related to phishing or a trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=insiders+guide+to+paris+hotels
    • http://gejopuzebizovuk.iblogger.org/korerimimajud.pdf
    • http://endi-itali.space/download_driver_may_in_brother_hl-2240d_win_10_64_bitlf4os.pdf
    • https://luzatewuxajexi.weebly.com/uploads/1/3/4/2/134265782/dezanizus-lanepomored.pdf
    • https://giliruba.weebly.com/uploads/1/3/1/4/131483170/fulupomuxafigon.pdf
    • http://ridunculus.com/tv_guide_baseball_playoffspm117.pdf
    • https://kaxozugusejerob.weebly.com/uploads/1/3/1/4/131452826/matisijarok-fijefisaxuko-kexuvalena-juwumipev.pdf
    • http://zupejuxe.iblogger.org/26399348503.pdf
    • http://nalutomabesuso.iblogger.org/spongebob_genetics_worksheet.pdf
    • https://nonafinawajag.weebly.com/uploads/1/3/4/3/134331790/6931382.pdf
    • https://dokerawu.weebly.com/uploads/1/3/4/3/134313580/xivudak-zijep.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://46a1ac71-481d-4a85-b709-d40f3a189542.filesusr.com/ugd/143c98_6c37788be1ef4c35bc7f08c7aae235fd.pdf?index=true
    • https://f1cb2ec4-a82d-4768-8a06-5236a2db220e.filesusr.com/ugd/a2e20a_9c0b3d10d47a4e35965c1741ba0b7396.pdf?index=true
    • https://s3.amazonaws.com/xipavir/arulnithi_songs_masstamilan.pdf
    • https://5741878b-e18d-4492-8bbc-c4e6c6b1c8bf.filesusr.com/ugd/e5a943_14228c343ef743bfbc81a4e8ba3250c0.pdf?index=true
    • https://47e244ab-6b1f-4ae7-97e8-86de5b619f9f.filesusr.com/ugd/e1d12c_ad9e26cd029f417faaa2bfb8562bb799.pdf?index=true
    • https://b7c0b8aa-2746-4b81-86ab-4dfcec723e12.filesusr.com/ugd/383078_fb4ee76ab78f42edbd22a29d2f32e027.pdf?index=true
    • https://b913155d-2712-4fd4-bcc6-651970a8c456.filesusr.com/ugd/e39924_ecb72807227443068545a825d4fdc33b.pdf?index=true
    • http://gunijeru.rf.gd/79535386649.pdf
    • https://63aa7d51-6c54-48cc-ac87-b710a0da19c3.filesusr.com/ugd/c8d394_982c212a04ab4f6780137541f2da98a5.pdf?index=true
    • https://df6a9abb-74f3-47e1-b359-fe6d1019da36.filesusr.com/ugd/7921d2_6c60fd9c43fd45148f557b3da2f0fe16.pdf?index=true
    • https://71a0d42b-91d5-4e94-9338-ff69ca8a624b.filesusr.com/ugd/e5d5e5_768ac49b17c24350a67ac10290b5df5b.pdf?index=true
    • https://s3.amazonaws.com/benuka/febagotawaj.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fcce.bin
61a5d10f74a2baf6b334aba45dab9498a52e3ad9961076fd73c004031d564cb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCCE 5160 bytes
font_01_sfnt_off00010e4f.bin
0562d2141cc2695dc63738212db395b975fcc45795b79775f82105a82a8279a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E4F 11840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.