Malicious PDF — malware analysis report

Static analysis result for SHA-256 01907070ecf0eb45…

MALICIOUS

PDF

76.3 KB Created: 2021-03-17 00:19:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5d08424533a5e2802ad94bb422198516 SHA-1: 04af64f932b8cb56dec02da4f7382f243f84cf59 SHA-256: 01907070ecf0eb45f3d0b0a9aa47cf77446bf8ac8ffb9d9b3c96a6f723d7f663
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious. Heuristics indicate it contains an external URI pointing to a suspicious domain and is part of a link farm, suggesting a phishing or scam attempt. The document body, though heavily obfuscated, contains keywords related to advance-fee scams, reinforcing the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=circle+of+fifths+pdf+free
    • http://bukibiroxofin.22web.org/72064252472.pdf
    • http://nosilekexiwot.mywebcommunity.org/l_anatomie__colorier.pdf
    • http://zelafagilu.iblogger.org/60310957858.pdf
    • http://wolifote.getenjoyment.net/xasesetomisikiwagevivikaz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a94931aa-64a6-4892-bba6-0f21b0c39dbe/casio_telememo_30_battery_replacement.pdf
    • https://s3.amazonaws.com/zarevizebi/81732445153.pdf
    • https://s3.amazonaws.com/suzujewa/adverbs_worksheet_ks2_tes.pdf
    • https://s3.amazonaws.com/nuvukivaxiren/27495359200.pdf
    • http://vivizegijarugip.epizy.com/nakaziwujuvejuripaboroja.pdf
    • https://s3.amazonaws.com/wizuluworafid/93368174068.pdf
    • https://s3.amazonaws.com/seriposuj/best_self_tanner_drugstore_2019.pdf
    • https://1b6fbac1-9b66-4609-9151-81f5d4c316f7.filesusr.com/ugd/5e81b9_c677bb358afd497dacef80dcb6268314.pdf?index=true
    • http://bowegasobufur.myartsonline.com/femelikixevajevir.pdf
    • http://punozelejewi.rf.gd/99687362123.pdf
    • https://uploads.strikinglycdn.com/files/869f87ba-1e35-4642-9075-7c8d33141de8/how_to_reset_my_onn_bluetooth_headphones.pdf
    • https://s3.amazonaws.com/jasipefulaxiduj/29342455400.pdf
    • https://s3.amazonaws.com/sukobogixe/best_free_alarm_clock_app_for_android.pdf
    • https://uploads.strikinglycdn.com/files/132768bc-ca23-47ed-82d0-9e48a3d1e50c/tc_helicon_voicelive_play_best_presets.pdf
    • http://pavabiza.atwebpages.com/gonipoviziwe.pdf
    • http://gagafexekoxoseb.epizy.com/23718870287.pdf
    • https://uploads.strikinglycdn.com/files/67b6ea61-054f-4761-b531-ab98a497a40f/76718629989.pdf
    • https://6bfd3344-23d3-4e03-ab7d-00c1c23eecf6.filesusr.com/ugd/be19e1_fb828eec6f5a4b629b6364f317093165.pdf?index=true
    • https://s3.amazonaws.com/jedadokuti/3411849460.pdf
    • https://uploads.strikinglycdn.com/files/1986781e-428d-46fc-936d-2b6e95041af4/8629330970.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f27d.bin
dd067ccc3a7cb28a02601f4be808e8f08b638aac1320052d7b910ccf69850caa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF27D 4936 bytes
font_01_sfnt_off00010343.bin
8466fb5560dcbeb6231e8b0ae4a5e93f67a46b81d57015694d26b60a45f4ffea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10343 12140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.