Malicious PDF — malware analysis report

Static analysis result for SHA-256 008abbf4d900049c…

MALICIOUS

PDF

83.5 KB Created: 2021-03-13 13:11:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7989c9f7f0d74b012e564a26aa395407 SHA-1: 6e9370eaf5d806deed320aa82b5163285711024b SHA-256: 008abbf4d900049c85c886ee913f0cdf8114f7bea6ae2ff449c91eddafc07d86
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing document and hosts a link farm. The embedded URL points to a domain associated with malicious activity, likely to redirect users to a phishing page or download a secondary payload. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=jam+speaker+won%2527t+turn+on+or+charge
    • https://cdn.sqhk.co/mapexovebo/gwvH6hj/37715917279.pdf
    • https://cdn.sqhk.co/porekige/lzo2K6c/canoscan_lide_210_manual.pdf
    • https://cdn.sqhk.co/lomuwomigez/pv8BNje/cracker_barrel_near_me_delivery.pdf
    • https://cdn-cms.f-static.net/uploads/4494147/normal_603e757f8a34a.pdf
    • https://cdn-cms.f-static.net/uploads/4412408/normal_5fd1a1d9c9645.pdf
    • https://cdn-cms.f-static.net/uploads/4447669/normal_603fb919209bd.pdf
    • https://safapovajedetux.weebly.com/uploads/1/3/4/6/134642125/8319274.pdf
    • https://bovopoboj.weebly.com/uploads/1/3/0/7/130776351/4994803.pdf
    • https://vilawamilufulob.weebly.com/uploads/1/3/6/0/136006615/9395245.pdf
    • https://kedigijolaga.weebly.com/uploads/1/3/4/3/134331451/pewomovoragitupusag.pdf
    • https://peziwavadeba.weebly.com/uploads/1/3/4/3/134313506/fakufujegevine.pdf
    • https://static.s123-cdn-static.com/uploads/4475580/normal_5ff0e88ba5006.pdf
    • https://cdn.sqhk.co/tovasodoj/icghXji/deputy_care_home_manager_jobs_essex.pdf
    • https://static.s123-cdn-static.com/uploads/4426549/normal_5ff767529fe98.pdf
    • https://cdn.sqhk.co/rosojolude/gcqghuP/66685459019.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/dorobukasawituw/baby_girl_bassinet_sheets.pdf
    • https://uploads.strikinglycdn.com/files/5ea519a1-95f6-4c85-93ac-3dcaa6606723/cfa_level_1_june_2020_curriculum.pdf
    • https://uploads.strikinglycdn.com/files/a1d8266d-c902-4c04-8811-dd4cbef2083a/formula_del_volumen_de_un_prisma_cuadrangular.pdf
    • https://uploads.strikinglycdn.com/files/e53ad9f6-aa9a-4db0-b0e2-7663f0b1bb30/85048072023.pdf
    • https://s3.amazonaws.com/purixifusipelid/authenticity_certificate_format.pdf
    • https://uploads.strikinglycdn.com/files/97b91b1d-3b3d-432d-8cd8-dc3ea2bf2f68/93877770217.pdf
    • https://uploads.strikinglycdn.com/files/3d269099-bc67-4238-8f50-910a9be77135/how_to_set_xfinity_xr2_remote_to_tv.pdf
    • https://uploads.strikinglycdn.com/files/437aea83-debe-427c-a734-4f1c7053db40/marigilupamukagesebixu.pdf
    • https://uploads.strikinglycdn.com/files/c04f28ab-ff6d-4efc-ab10-393df1627347/hp_officejet_6500a_e710a-f_treiber_download.pdf
    • https://uploads.strikinglycdn.com/files/42c87c54-95b0-4bce-acba-e41522bba044/58640230881.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f896.bin
8a5d60b7f1fa99799ca028ae9e27278b22b226f6531a115e85062831687c8074		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF896 5328 bytes
font_01_sfnt_off00010aa1.bin
d77cb003bc71d2a443748b6a05789ab410ab6219fb327238c4347e4c677b8513		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AA1 11020 bytes
font_02_sfnt_off0001304d.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1304D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.