Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe1f788d604e0226…

MALICIOUS

PDF

86.7 KB Created: 2021-03-30 10:52:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2712aef0152bd303b76381d72cedb9bb SHA-1: 5e106808d345cc116b8b24ab8e787a1e7e2ebce7 SHA-256: fe1f788d604e0226c61e15360a7db2f440d39f92d005cf9b34f1afe0fd6139cc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics and a machine learning classifier as malicious, specifically as a phishing or SEO spam campaign. It contains a large number of embedded external links, with the primary one being to 'https://golowaki.ru/wix?keyword=bdo+warrior+guide+reddit'. The PDF structure itself is also indicative of a link farm, with 30 external PDF links identified. No scripts were extracted, but the extensive linking suggests a primary goal of redirecting users to potentially malicious or spam-laden websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=bdo+warrior+guide+reddit
    • http://torudowe.22web.org/the_architect_s_studio_companion_download.pdf
    • https://finolija.weebly.com/uploads/1/3/4/6/134625313/zopomefud.pdf
    • https://jurexufibemoso.weebly.com/uploads/1/3/4/3/134310147/2503499.pdf
    • https://zoxukumej.weebly.com/uploads/1/3/4/3/134327216/d42733e93e6544.pdf
    • https://megularebenava.weebly.com/uploads/1/3/1/1/131164421/savarimu-jakamafa-segidinijojati.pdf
    • http://wafolepis.iblogger.org/intrapartum_care_rcog_guidelines.pdf
    • https://kefagifugujog.weebly.com/uploads/1/3/0/8/130813645/tarubazebedurelajo.pdf
    • http://zarumesa.mypressonline.com/join_i_love.pdf
    • http://gagefiwirimat.medianewsonline.com/vezewakuvapaxotimu.pdf
    • https://sirazetagur.weebly.com/uploads/1/3/5/3/135328448/futiduxabatef.pdf
    • https://sexevegafuxa.weebly.com/uploads/1/3/6/0/136083832/9729699.pdf
    • https://wuselusovofose.weebly.com/uploads/1/3/1/1/131164562/f1187a.pdf
    • https://tatuwimo.weebly.com/uploads/1/3/4/8/134882860/jejunu_bajenoli_vakebagawivo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/822fea5b-a791-4101-9e7e-f7d8bd079c59/luteleburogijotawemoxo.pdf
    • https://93dbb2ad-f1e8-4c6c-adfd-2ef134399473.filesusr.com/ugd/df4650_f5d7f4b5c3df425890280713d6108901.pdf?index=true
    • https://be5a03d2-cb36-429a-bb4d-4773f067dd3b.filesusr.com/ugd/b46ca8_1b0a52aac4094c6bb0ad32781aa64127.pdf?index=true
    • https://uploads.strikinglycdn.com/files/18128ffe-9dd5-47d8-b41c-08f29e390d55/2875641678.pdf
    • http://roxujewov.myartsonline.com/lean_muscle_mass_diet.pdf
    • https://adea4596-07c4-4c45-ba97-107779ed6dc5.filesusr.com/ugd/5bd9e2_f6655dc9cf494c3795352db27e6fbe61.pdf?index=true
    • https://75a697d3-84f0-44cf-bab9-f05e37020c50.filesusr.com/ugd/7c3584_ef734a644f474a4a8e55ad2130b11e62.pdf?index=true
    • https://f5f74d4f-f804-4d9b-9bfa-9964b2756261.filesusr.com/ugd/e389b3_a4ae785530d14743a2feb0ace77b69ca.pdf?index=true
    • https://uploads.strikinglycdn.com/files/de353ad8-3795-4ed6-ad2b-4b6cae92c67b/what_if_movie_trailer_song.pdf
    • http://retomog.epizy.com/wixoxiku.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011443.bin
037e15acfea2268c7368c12e9700ff85e8253b0f7f76c008e0661ce991e776d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11443 4924 bytes
font_01_sfnt_off00012529.bin
9aed8e2accdbab283379c0ba7ea2b5830b41ca6a259512d01f83eec3c1abee7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12529 11856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.