Malicious PDF — malware analysis report

Static analysis result for SHA-256 fed8eb8d54c96dc3…

MALICIOUS

PDF

101.2 KB Created: 2021-03-16 01:08:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6b177a1cee0ea8aee7fa98e588b7f216 SHA-1: 5124d57865e348fec91e4aa731a25c12140c4094 SHA-256: fed8eb8d54c96dc320266115ea07f3be186fc0a057f59d6de62ee917ea01755b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for SEO poisoning or phishing campaigns. The primary URL, 'https://resalured.ru/award?keyword=biology+gk+in+bengali+pdf', suggests a lure related to educational content to entice clicks. ClamAV and ML classifiers strongly indicate malicious intent, likely related to phishing or distributing further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9945

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=biology+gk+in+bengali+pdf
    • https://gizutiki.weebly.com/uploads/1/3/4/4/134478998/miliboru.pdf
    • http://safagiko.iblogger.org/35844752669.pdf
    • https://cdn.sqhk.co/tugirujozi/m5gmheR/kepisetupowiliseri.pdf
    • https://cdn.sqhk.co/pomodizad/dTyjhih/authorized_representative_form_medicare.pdf
    • https://cdn.sqhk.co/rabataxuvax/G2xigjd/business_plan_template_excel_south_africa.pdf
    • http://nuzidixiwetor.22web.org/jijufef.pdf
    • http://dubotivuga.22web.org/pdf_buku_agama_buddha_kelas_10.pdf
    • https://cdn.sqhk.co/guzoladip/ibnji7r/aashiqui_2_movie_video_song_bestwap.pdf
    • https://jagunafine.weebly.com/uploads/1/3/4/3/134363358/dd46843c0853.pdf
    • https://jewizebalize.weebly.com/uploads/1/3/4/6/134618682/3496632.pdf
    • http://bavujiburivege.iblogger.org/41578694256.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7b6eef9a-7352-448c-8e80-911c5f2e1c0b.filesusr.com/ugd/f34323_311d17c87beb42229c6e7847aba7325c.pdf?index=true
    • https://s3.amazonaws.com/jaxesabi/vmware_workstation_12_filehippo.pdf
    • https://411be8f8-4ba1-40b5-9edf-cc4a2c3d5ecc.filesusr.com/ugd/a86d68_20166df198b54fdebad09816a1ea1278.pdf?index=true
    • https://d2d87fd5-5f4d-49aa-ab3c-2263ce4b5d22.filesusr.com/ugd/9169d2_215342b6ec964dfd8758c7f0669f4f59.pdf?index=true
    • https://uploads.strikinglycdn.com/files/70952f49-a93f-4acd-9f4a-1d6c160d8cd3/41636735762.pdf
    • https://s3.amazonaws.com/jovekus/where_to_donate_used_furniture_in_durham_region.pdf
    • https://6d4cd3b7-91e9-43ac-92b9-205473f1e50d.filesusr.com/ugd/28146e_6bf865684726487199ee1daaaddd2c63.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3369f10a-4832-48a2-a1ac-9a0a5d48af6a/nawesidolowozobiteputep.pdf
    • https://uploads.strikinglycdn.com/files/d9de8432-4768-4cc5-96dc-d9b5e524b15f/problemas_de_porcentaje_para_nios_de_quinto_grado_de_primaria.pdf
    • https://s3.amazonaws.com/tokatefozude/west_side_story_full_movie_free.pdf
    • https://uploads.strikinglycdn.com/files/5f7e2f69-3334-4567-98ca-20b4189f4ccb/motor_speech_disorders_duffy_4th_edition_ebook.pdf
    • https://uploads.strikinglycdn.com/files/c990e962-c6dc-4bc8-b7e7-67eebbc5db9e/mathematics_textbook_class_7th.pdf
    • https://3ea853e4-7f2b-4fb0-9229-b04907a1e321.filesusr.com/ugd/d94095_6458983b5adc4b9ca36d3ad70402a0b5.pdf?index=true
    • http://rovunebezub.epizy.com/nuwixetumopori.pdf
    • https://s3.amazonaws.com/mubefula/childrens_stories_online_free_to_read.pdf
    • https://s3.amazonaws.com/nijosinizo/journal_citation_reports_science_edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c20.bin
f61974f3dec5b83e4afc6526d2a93690eb0b1a056cee94a8e41618a103f0b674		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C20 5288 bytes
font_01_sfnt_off00011e45.bin
d91913954ec3d3af1ede3ee9bd9ed7029318e6f3366eb272d12636b391b9fe52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E45 24704 bytes
font_02_sfnt_off00016001.bin
15fa505139c6dd84e0c404b2153e1b86376ed668c5fa37778246c57560d63f07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16001 10988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.