Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe308a73e947cfeb…

MALICIOUS

PDF

85.4 KB Created: 2021-03-24 06:52:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a4a10a9106599bb4817b117c587ea1be SHA-1: 90d7f0c084443a686cc711396dd3c4c515ce2982 SHA-256: fe308a73e947cfeb8c8639b6e6227954cca68d3ab6dd6cef2f00bc61b0e35486
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document is designed to host numerous external links, with 'soxebez.ru' and a Weebly-hosted PDF being prominent examples. The presence of embedded URLs and the nature of the heuristics point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=ajooba+movie+full+hd+video+songs
    • https://remitibomuko.weebly.com/uploads/1/3/4/8/134853657/d8b893.pdf
    • https://static.s123-cdn-static.com/uploads/4464078/normal_5fcdd952aa5ac.pdf
    • https://finudekenituw.weebly.com/uploads/1/3/6/0/136053274/vosezitimifutovi.pdf
    • https://cdn-cms.f-static.net/uploads/4482617/normal_5fd8100c5575d.pdf
    • https://jumojebanofoz.weebly.com/uploads/1/3/5/3/135302369/6530341.pdf
    • https://xudomulur.weebly.com/uploads/1/3/4/0/134040538/5780667.pdf
    • https://cdn-cms.f-static.net/uploads/4366312/normal_603ab05a06def.pdf
    • https://woxogobigevi.weebly.com/uploads/1/3/0/8/130814596/6861901.pdf
    • https://cdn-cms.f-static.net/uploads/4427077/normal_60272450e8ae4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/pekatikisuruki/layered_architecture_in_computer_network_in_hindi.pdf
    • https://s3.amazonaws.com/sizadagazagaj/twilight_saga_part_2_full_movie_in_hindi_dubbed_download.pdf
    • https://83f018a0-8e49-44f0-b57e-805e464a5f06.filesusr.com/ugd/10a4aa_1d29a9675c29419fb280cc31d3e70b34.pdf?index=true
    • https://8bd0dbf5-62e0-4684-a95a-1d9666dfa34a.filesusr.com/ugd/e71694_2efd4cd5167542ee90b7f82b86818a1f.pdf?index=true
    • https://s3.amazonaws.com/roxawo/lumudufevasinopidatabub.pdf
    • https://s3.amazonaws.com/piradi/templates_materialize_css.pdf
    • https://s3.amazonaws.com/zopenave/boone_and_crockett_score_sheet_black_bear.pdf
    • https://s3.amazonaws.com/dozuga/service_cloud_consultant_certification_study_guide.pdf
    • https://s3.amazonaws.com/gurafoga/59638347949.pdf
    • https://s3.amazonaws.com/wujapu/dental_trauma_guidelines_subluxation.pdf
    • https://s3.amazonaws.com/purawuma/barbie_doll_ki_photo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe89.bin
b8c8d6f7bd8ed0ec52e51c3b37ec7826d4b17dbe518619711e67fb0083cca009
pdf-font-stream PDF embedded font (sfnt) at offset 0xFE89 5292 bytes
font_01_sfnt_off0001106b.bin
eb4f143a8e346f94ee389ffe8394f07312878b2e74c8c13c01094d80b3330471
pdf-font-stream PDF embedded font (sfnt) at offset 0x1106B 12052 bytes
font_02_sfnt_off000138a4.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361
pdf-font-stream PDF embedded font (sfnt) at offset 0x138A4 4324 bytes