Malicious PDF — malware analysis report

Static analysis result for SHA-256 033021ff53a928f2…

MALICIOUS

PDF

78.5 KB Created: 2021-03-28 11:47:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e7dd4d7d73efe235f6832f0790cee60e SHA-1: dd0bb930ee6c10b0dc094636296987531aea0f03 SHA-256: 033021ff53a928f2cebc8456acf3271a2af8fc59f7d6992fb8301905cc0db006
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. The presence of a link farm heuristic further supports the malicious nature of the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=triple+bunk+bed+plans+pdf
    • https://static.s123-cdn-static.com/uploads/4469837/normal_5ff8608608155.pdf
    • https://cdn-cms.f-static.net/uploads/4500878/normal_603da7b37e09e.pdf
    • https://cdn-cms.f-static.net/uploads/4459784/normal_5fd1a719c774f.pdf
    • http://gdztut.com/numigedebapifowyi.pdf
    • https://cdn-cms.f-static.net/uploads/4495684/normal_603b62e7ca6ec.pdf
    • https://static.s123-cdn-static.com/uploads/4465543/normal_5ffb925a8c4ef.pdf
    • https://static.s123-cdn-static.com/uploads/4465396/normal_5ff24bba488d7.pdf
    • http://help-violation.com/childrens_rugs_walmartgxsyt.pdf
    • https://static.s123-cdn-static.com/uploads/4496391/normal_5fffd2ee0dd56.pdf
    • http://everydays.space/widawekejefisabpl7s.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_122076f8d8704005904aa08eaa318192.pdf?index=true
    • https://s3.amazonaws.com/wobuzisibal/what_are_the_aa_spiritual_principles.pdf
    • https://69cf8a46-0d3d-4b71-8fd1-93df925da18e.filesusr.com/ugd/e4064d_513221ac7bc049e58272f4331051daf1.pdf?index=true
    • https://s3.amazonaws.com/divelikubapiwaj/19584058187.pdf
    • https://1d942ef5-affb-47d8-8f99-70a3d187b733.filesusr.com/ugd/3283b0_5e314cba164e466fbe6286d45d4435e6.pdf?index=true
    • https://d09251a9-b09e-4077-8ccb-24037f005f7b.filesusr.com/ugd/a6ce17_aa2b6acfe78c4575abafe808a0060fc3.pdf?index=true
    • https://4d3f6715-1114-433d-a4b7-45a5e22e3858.filesusr.com/ugd/ce86b4_b0388b99dc5643279efedb3ee0fd7c59.pdf?index=true
    • https://71a5d838-4e22-4830-8da1-7955ec3365f5.filesusr.com/ugd/f2f43e_be2c6e1f94794881b01c278b16de3775.pdf?index=true
    • https://s3.amazonaws.com/feborobegibew/39938545068.pdf
    • https://0eb00d84-361a-45dc-b346-1af5c8eb785c.filesusr.com/ugd/d79848_68084faea10940c1ae13135bbd53aa30.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f568.bin
92483c22f890eb51b8d2952c95fe1caf8bc8d55637690db2c63f762ac3cfbc2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF568 5188 bytes
font_01_sfnt_off00010712.bin
c8c89ac46365dd3e41b270e37ad7d138908dd397427cd29b9ff63f136b6cee6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10712 11336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.