Malicious PDF — malware analysis report

Static analysis result for SHA-256 021f91897dde8405…

MALICIOUS

PDF

76.1 KB Created: 2021-01-28 04:16:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 6eb908e892809c1c870a3b5377ea1f85 SHA-1: 128c34104607cd941235d4cb9b7106be3edc7385 SHA-256: 021f91897dde8405a7369483fbbdd7f0c437037e43756d8ef54f2e85c159a2ab
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, specifically identified as a phishing trojan by ClamAV. The primary malicious activity observed is the presence of a large number of external links, suggesting a link farm or redirection scheme. While no scripts were explicitly extracted, the PDF structure and the nature of the links indicate potential for JavaScript execution or further malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=first+generation+pontiac+firebirds+for+sale PDF link annotation
    • https://cdn.sqhk.co/foroboreb/nif7Rji/cookie_clicker_cheat_codes_sugar_lumps.pdfIn PDF document text
    • https://zawuziwoju.weebly.com/uploads/1/3/1/6/131636930/c88ba0cbce7.pdfIn PDF document text
    • http://wavikedinufefe.iblogger.org/37901350801.pdfIn PDF document text
    • https://dekitinuro.weebly.com/uploads/1/3/4/8/134871397/0b8936ce73.pdfIn PDF document text
    • https://cdn.sqhk.co/sadetujadufi/hhahdSA/xubigegil.pdfIn PDF document text
    • https://wubinuju.weebly.com/uploads/1/3/4/6/134642725/juguxixela_veguwa_jepezezupi_luzaxazowuxogut.pdfIn PDF document text
    • https://cdn.sqhk.co/javufikari/hgOgfhe/xofogozemosuvumex.pdfIn PDF document text
    • https://paruralevefux.weebly.com/uploads/1/3/0/7/130775474/3907365.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kakekojezutok/71883326298.pdfIn PDF document text
    • https://s3.amazonaws.com/fipijife/49764601114.pdfIn PDF document text
    • https://s3.amazonaws.com/dobesogum/case_study_interview_questions.pdfIn PDF document text
    • http://gokixedotoj.epizy.com/basic_atomic_structure_worksheet_doc.pdfIn PDF document text
    • http://mupufuten.epizy.com/ama_bibliography_format_website.pdfIn PDF document text
    • https://s3.amazonaws.com/posufij/5371056872.pdfIn PDF document text
    • http://kunijudodo.rf.gd/70399690193.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC14 5420 bytes
SHA-256: a791509acbc6a0bba705425ee8faa40813d9ce2c22b957d430d84dc1c25b44b7
font_01_sfnt_off0000fe8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE8D 10912 bytes
SHA-256: 763724b696f4513a85ea05ee3267e386f4dc9264e68d852672208efcf917d115

Open this report in the interactive analyzer, or submit your own file for analysis.