Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff1ceee81e4914b8…

MALICIOUS

PDF

74.6 KB Created: 2021-03-15 07:32:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2bad93b5a0f1784c329afbdffd18a3c0 SHA-1: 516282817ce10deb39cbfbe0c8dbf7489431bc0f SHA-256: ff1ceee81e4914b84d93d411bb1ea75e896d71cd771e7a866b55bf0d2143d3a0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to potentially malicious domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a phishing trojan. While no scripts were explicitly extracted, the presence of embedded URLs and the overall structure point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=skyfall+adele+orchestra+sheet+music
    • http://kufafukedexepix.mygamesonline.org/2045769052.pdf
    • http://mirijesuwakug.sportsontheweb.net/34359141222.pdf
    • http://sotarebesowula.medianewsonline.com/colibacillosis_pada_ayam.pdf
    • http://sizerasadaxer.mywebcommunity.org/mathematical_analysis_by_sc_malik.pdf
    • https://cdn.sqhk.co/sexuzoropa/oQheggx/vida_integrated_health_jobs.pdf
    • https://cdn.sqhk.co/nonagidux/gddmhig/adjectives_and_prepositions.pdf
    • https://cdn.sqhk.co/kafexobesa/Bja0Jha/34672926505.pdf
    • https://cdn.sqhk.co/fajoliteve/eji7pTg/ivory_color_men_s_shirt.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/donake/seagull_training_answers.pdf
    • https://cb70cc59-2297-49c3-b7e2-2ac7e26e28d4.filesusr.com/ugd/4479ed_d91eb4a71d764e019a64761098934321.pdf?index=true
    • https://s3.amazonaws.com/fejatepudopito/chained_to_the_rhythm_sheet_music.pdf
    • https://4cf6c2b4-cd84-4b73-83b1-bf7f441162b2.filesusr.com/ugd/e50c99_32deada7665b4cfebb231198066887b1.pdf?index=true
    • https://7f1888b6-cdab-4603-9914-1cf81a8b29aa.filesusr.com/ugd/6846fe_867f2a28befc47b29707e44a65633373.pdf?index=true
    • https://e8dc5420-792a-4861-90db-09cfc8d8a7d1.filesusr.com/ugd/1378f5_5e697a05cd6844f3a6b04cd8e6567b7a.pdf?index=true
    • https://f6ce3cfb-f922-470c-9e0e-eaf724001b0e.filesusr.com/ugd/defcb2_58351326bd3f458f9450bd3d49ccca53.pdf?index=true
    • https://ef9935f7-a918-44a1-999f-f1d50a45e4a7.filesusr.com/ugd/b463f2_f0e84b093b7f453aa30f95bd7fd09965.pdf?index=true
    • https://s3.amazonaws.com/lomiwexuva/570425522.pdf
    • https://35057dd6-1d18-4acd-96c9-af3b7fddc7cd.filesusr.com/ugd/978dd5_e187229cb5b841d09e402e0293e7059e.pdf?index=true
    • https://s3.amazonaws.com/dufekifaral/befadodepo.pdf
    • https://s3.amazonaws.com/tolivajupeku/66384079654.pdf
    • http://lutepotazor.onlinewebshop.net/biscuits_recipe_books.pdf
    • https://a6f18165-9bfd-46c9-8f51-0ab50cd0b687.filesusr.com/ugd/265c7a_b45b79cb2b0c4c679f80c50c47741586.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d62f.bin
c1155dad48e43a2b3c22ffabeccad843f01ef6fef9bf70e5693d862c6a2698b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD62F 5304 bytes
font_01_sfnt_off0000e83b.bin
3f533280a2980699b9ad4df2c479e542ecefec56d6241c2c75528122fd7c4277		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE83B 11296 bytes
font_02_sfnt_off00010eea.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EEA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.