Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd1de2c1d497da08…

MALICIOUS

PDF

85.3 KB Created: 2021-03-07 15:09:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e8d7f1924fec7c29ce1c15d6694c920 SHA-1: e8893d16b0fceee0f1f94dbf7576b1c3aab1f037 SHA-256: fd1de2c1d497da083377ae20741f509972736f5f37df83efad4ad034e9ba4ca4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a phishing or SEO spam campaign. ClamAV detection and ML classification confirm its malicious nature. While no scripts were explicitly extracted, the PDF structure and numerous URLs point towards an attempt to redirect users to malicious or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=cool+math+b+cubed+unblocked
    • http://soul-felt.com/sniper_3d_assassin_cheats_without_human_verificationf3mew.pdf
    • https://teduzagegoxow.weebly.com/uploads/1/3/4/4/134400331/gemowabikinin_kitovanoto_fiped.pdf
    • http://vovpomnim.ru/careers_in_psychology_worksheet_answers35iyy.pdf
    • https://cdn.sqhk.co/rifojimuna/Xha5M8n/download_euro_truck_simulator_usa_mod_apk.pdf
    • http://larts.digital/838951253150ynyv.pdf
    • https://vopevejefed.weebly.com/uploads/1/3/1/6/131606133/fenafirupisixi.pdf
    • https://cdn.sqhk.co/pilozarager/jehgX6g/dragon_hunters_full_movie_english.pdf
    • http://lnstagramverifycentre.com/minn_kota_ulterra_trolling_motor_problemsf5gyh.pdf
    • https://bozaxemavokasum.weebly.com/uploads/1/3/1/3/131383719/pabebobide_sarojagagalona_ximujejurivog.pdf
    • http://makeyourself.xyz/what_is_the_best_brand_of_pellets_to_buy_for_a_pellet_stovex5k5f.pdf
    • https://cdn.sqhk.co/borefigux/vhdo5jf/lojejijowototamazekox.pdf
    • http://de-bewertung-id2842384.icu/jixav194qq.pdf
    • http://eurosett.net/bividov7ahn.pdf
    • http://shopsmmv.site/hallmark_the_night_before_christmas_pop-up_book_with_light_sounddtgeq.pdf
    • http://adanakebap.org/gepebobugowafekws26i.pdf
    • http://vvinorama.website/gemoburam8vwh.pdf
    • https://nezozavigarej.weebly.com/uploads/1/3/4/7/134727028/duzuvutigesujer.pdf
    • http://helplnstagramcontact6088757.com/past_of_listen_verbfmmpd.pdf
    • https://sesifubonimexa.weebly.com/uploads/1/3/5/3/135317238/857d3fe.pdf
    • http://micrometerdigital.xyz/el_conde_lucanor_personajes_y_temassbm9d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.indictrans.org
    • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_65cb737a18fa4badabf74c8f84cebdda.pdf?index=true
    • https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_676b33ba03744d41a33f38770c39f945.pdf?index=true
    • https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_2aa7714255f343e3b38afa265ab5da94.pdf?index=true
    • https://d5f1d3db-1598-48d0-a061-764c190a6564.filesusr.com/ugd/866690_7ea8635ca7f04b9ebb72600b537133f3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f87d.bin
c643805a23c23e6b17bed83a11719817047f01150546a680cb19231bcb3feddf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF87D 5012 bytes
font_01_sfnt_off00010955.bin
130fc890ba761ad43692d463f06e18e4a6124bfc1d2ef299288ad2a03700e403		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10955 6748 bytes
font_02_sfnt_off00011f56.bin
848a1d1b6aaf8569478840f62cdc69ca4bf591e515e048d987bc35d29c185545		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F56 12452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.