Malicious PDF — malware analysis report

Static analysis result for SHA-256 0026a0c25026546e…

MALICIOUS

PDF

72.0 KB Created: 2021-04-27 01:42:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 9a9714f4da3959c8e5ca1a51d8521834 SHA-1: 1f63561dc7ce3c1d15b4aaad8c2132ed12bf541b SHA-256: 0026a0c25026546e730b9a1cca9d0b5668e1b84c0f0690472cb820fd1f18811a
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to seemingly unrelated PDF documents, suggesting a link farm for SEO manipulation. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely instructs the user to download a password-protected archive, a common tactic to bypass gateway security. ClamAV detection and ML classification confirm its malicious nature, likely as a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=marks%2527+basic+medical+biochemistry+a+clinical+approach PDF link annotation
    • http://zifeladawu.scienceontheweb.net/afghanistan_war.pdfIn PDF document text
    • https://bisigibibozika.weebly.com/uploads/1/3/4/4/134438783/negonodav.pdfIn PDF document text
    • https://wigabededonekan.weebly.com/uploads/1/3/0/7/130740374/eca9e1401358b.pdfIn PDF document text
    • http://legko.travel/86478840762yhpck.pdfIn PDF document text
    • http://rankingcoach-apps.com/guided_by_voices_bee_thousand_zipzu1wj.pdfIn PDF document text
    • https://zudopawugaweso.weebly.com/uploads/1/3/4/3/134343229/834740.pdfIn PDF document text
    • http://usmileofficial.site/does_dominos_put_msg_in_their_foodcwq3t.pdfIn PDF document text
    • http://itfamily.info/pogunixubh996.pdfIn PDF document text
    • http://xepewifub.mygamesonline.org/guzebavujame.pdfIn PDF document text
    • http://vutunema.mypressonline.com/walmart_tv_65_inch_stand.pdfIn PDF document text
    • https://tuzatorigipixaz.weebly.com/uploads/1/3/4/3/134321964/fomenum_duresiwumi_dotuguzonivev_pavamatapasarug.pdfIn PDF document text
    • http://apkweb.net/op_amp_numerical_questions_and_answers5m9du.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/davawina/simplicity_lawn_mower_maintenance_kit.pdfIn PDF document text
    • https://eb33cad6-2cca-4ff0-b9af-98554ee8f71a.filesusr.com/ugd/b3bc21_feafba0afd324a27b85a452baacebbc6.pdf?index=trueIn PDF document text
    • https://d70b1dc8-7d09-4148-9854-e6a7cae1b87b.filesusr.com/ugd/5899d5_62640e3479f04bc88e5581eec0e62388.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zubuwujoxom/binary_search_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/dewazewokib/cisco_rv320_admin_password.pdfIn PDF document text
    • https://d650f791-4ca6-4964-96f1-ba9fac0414c1.filesusr.com/ugd/adf9cb_26d35a89c4ed40d7b2d016159f042fb3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/paxunu/59625838400.pdfIn PDF document text
    • http://gubawakelu.onlinewebshop.net/bosch_800_series_dishwasher_panel_ready.pdfIn PDF document text
    • https://s3.amazonaws.com/wesezuzuvalirik/83270912177.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d85c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD85C 5656 bytes
SHA-256: 68dc57cedb7f38481565d46d5f46918ddf786e8194c57d86d7678a137ba8cdd3
font_01_sfnt_off0000eb88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB88 11488 bytes
SHA-256: e886ae2694567aaaa6f0653c1456e16ac74cd4cb556cc1871353d95af38078cf

Open this report in the interactive analyzer, or submit your own file for analysis.