Malicious PDF — malware analysis report

Static analysis result for SHA-256 fccee5dacd9af06d…

MALICIOUS

PDF

82.8 KB Created: 2021-03-19 06:23:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d58666feabd7342551f4323441a7f492 SHA-1: 7bd3a5abca38293c8bdf42f8bb46bc052ab58e14 SHA-256: fccee5dacd9af06d913eb52a7283e26ecb9822a7688e0cf7d06c9707589f3832
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains numerous external links, with a primary focus on a URL that mimics a search result for a game mod. This suggests a phishing or malware distribution attempt. The ClamAV detection and ML classifier strongly indicate malicious intent, likely involving exploitation of PDF vulnerabilities to redirect the user. No scripts were extracted, but the PDF structure and embedded links are indicative of a malicious lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=south+park+phone+destroyer+mod+apk+4.7.0
    • https://cdn.sqhk.co/nazopekujavi/i122whc/bitlife_prison_escape_routes_5x7.pdf
    • http://redtea.space/84762009311cacmp.pdf
    • http://keto-s1.com/tadix8hqth.pdf
    • https://cdn.sqhk.co/gukugifixija/oicknhc/bertram_fiddle_episode_1_walkthrough.pdf
    • https://cdn.sqhk.co/dobexesi/hezZ1Yr/media_player_windows_7_32_bit.pdf
    • https://cdn.sqhk.co/zujumatatub/dIgh1ha/amazed_lyrics_new_life_worship.pdf
    • https://cdn.sqhk.co/dikizumi/jhj2Lhf/25894044982.pdf
    • http://present-mag.ru/war_commander_rogue_assault_cheat_enginep8f3f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tobovunoberiki/do_ipod_nano_3rd_gen_have_bluetooth.pdf
    • https://uploads.strikinglycdn.com/files/3672eb37-41c2-49c3-b5e4-70a6e2aa3943/tefutibelojikova.pdf
    • https://uploads.strikinglycdn.com/files/75c7b542-1f34-4b19-9cea-0fdd236aee96/16246751880.pdf
    • https://uploads.strikinglycdn.com/files/d5dc885d-9310-400c-af04-b4a8e2fa13f4/kosuziladapemabukoxiga.pdf
    • https://s3.amazonaws.com/farokof/33923170398.pdf
    • https://s3.amazonaws.com/dotivaf/british_gypsum_gyproc_plasterboard_data_sheet.pdf
    • https://s3.amazonaws.com/baxunaf/blue_background_image.pdf
    • https://uploads.strikinglycdn.com/files/464ff104-d835-48b6-99a9-56806ae6d671/epson_xp_200_wifi_light_flashing_orange.pdf
    • https://uploads.strikinglycdn.com/files/1075614e-8424-4c67-b1e6-d90eff006388/89004620461.pdf
    • https://s3.amazonaws.com/tuletivotarupu/uc_browser_app_filehippo.pdf
    • https://e5447efa-8854-4d04-834e-f0bbd7438c8b.filesusr.com/ugd/ac612b_a407c7d57c04459d946b40abfa85f79d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1f03852b-afa6-44a0-9218-2af5ef2c45df/wewugojobokutubonanoruke.pdf
    • https://uploads.strikinglycdn.com/files/1a87d17d-5228-4ed2-8267-d8a1704add95/9196929273.pdf
    • https://f3dbd103-cf2f-44fc-b0ad-c9004dc38af2.filesusr.com/ugd/1f2646_a5c4a41e1c4c440ea8af265808f6ed31.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3dc154e4-2184-45e9-b81d-db37b5adc316/delorme_inreach_explorer_two_way_satellite_communicator.pdf
    • https://uploads.strikinglycdn.com/files/d925e06d-af19-4a9d-91cf-2480f5c448e0/samsung_un55ju6500_price.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f13b.bin
495dc75d95a6a6f45ac0640accda880cdd7226211fb355277ff836c691f61857		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF13B 2960 bytes
font_01_sfnt_off0000fba9.bin
68e9e3595027ff979362bd3fbf8bd508f088eb561691bbddc0414ff3667f633a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBA9 5776 bytes
font_02_sfnt_off00010f43.bin
75e9f73a078bc8eac490cbcb30c9d606bc3cbf23badf92ad02025ada6138ea70		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F43 13484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.