Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd9b5cd5eae6ca18…

MALICIOUS

PDF

79.6 KB Created: 2021-03-10 01:40:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 1cfa633bbe433bd045e598bfa81ce0e3 SHA-1: 797d529af52012831639a3f6369d3060ef0bed02 SHA-256: fd9b5cd5eae6ca18f398831d767f525cd804fc719454ecf9e20efd1d1e4a15ea
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ML classification and ClamAV, indicating malicious intent. It contains a large number of external links, with one pointing to 'https://pelibifir.ru/award?keyword=candide+voltaire+pdf+r%25C3%25A9sum%25C3%25A9', suggesting a phishing or content-luring attack. The presence of numerous links and the overall structure are indicative of a link farm or SEO poisoning technique used to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=candide+voltaire+pdf+r%25C3%25A9sum%25C3%25A9 PDF link annotation
    • https://cdn.sqhk.co/zativojor/Cgjiaii/why_did_chicken_cross_the_road_answer.pdfIn PDF document text
    • https://cdn.sqhk.co/gubisagebuto/ghnS3qV/faduluwudavafugepuvogiko.pdfIn PDF document text
    • https://cdn.sqhk.co/vojofarakiva/LkijJPG/labyrinth_maze_game_online.pdfIn PDF document text
    • http://fudidudigas.iblogger.org/can_jumping_jacks_reduce_belly_fat.pdfIn PDF document text
    • https://cdn.sqhk.co/wuwosexed/d5gd4pe/19841850822.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wegugus/45115841822.pdfIn PDF document text
    • https://s3.amazonaws.com/taturi/first_line_treatment_for_hypertension_nice_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/wixamupelinere/criminal_netflix_episode_guide.pdfIn PDF document text
    • https://b32521b7-32ca-447e-9967-d27d0dce683d.filesusr.com/ugd/800b88_6d5905402f324ccc9c4c7c01613b8eba.pdf?index=trueIn PDF document text
    • https://af1bea64-f5cd-41c2-a7c1-97f21c1aa057.filesusr.com/ugd/592671_7133b0394f9341c3851cea2effc11499.pdf?index=trueIn PDF document text
    • https://a9f3490c-def6-45ea-9957-aefa341d54bd.filesusr.com/ugd/84b587_96e9421f29044ec6a0dc96a468f0c7b3.pdf?index=trueIn PDF document text
    • http://kisaxutuse.epizy.com/zeregubulobogu.pdfIn PDF document text
    • https://b8436764-02b3-4471-8711-1e8fed235cf0.filesusr.com/ugd/3b3fbb_2536a098340f4302a3b03ab323d1d7d8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mafavuzenoliki/askep_addison_disease.pdfIn PDF document text
    • https://24218389-b518-4ca3-8548-65eaf758daa4.filesusr.com/ugd/c836c3_704b5453760d4731b691460125c0eb24.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sukedil/bindiff_windows_10.pdfIn PDF document text
    • https://d6aab468-caab-4d9e-910f-d3bf64ae4104.filesusr.com/ugd/5438e3_962264a8ce6942508d8734111464d1c4.pdf?index=trueIn PDF document text
    • https://932aa67c-856a-4fda-9fc8-fe3f50d4acc2.filesusr.com/ugd/a25eee_0d337cb115e74f1dbd172418f34a0b9b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gazitif/nfl_injury_report_after_week_5.pdfIn PDF document text
    • https://s3.amazonaws.com/jagux/steering_committee_report_companies_act.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6E8 5292 bytes
SHA-256: 559084f5762d83b8e4eb9dd714663e975064ab57b22652d003c3c8dbd9acae00
font_01_sfnt_off00010895.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10895 12608 bytes
SHA-256: dba91c204c5bc64780f13948958f80ff42b56844554a83b94da73517a5b0adcd

Open this report in the interactive analyzer, or submit your own file for analysis.