Malicious PDF — malware analysis report

Static analysis result for SHA-256 064db0af738acb58…

MALICIOUS

PDF

117.5 KB Created: 2021-03-31 14:04:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 850b0f6eaf7ee0fb38be965cb0150cc3 SHA-1: e868ba56fc72aef86d8a15cb9fa9a4f86c203c9e SHA-256: 064db0af738acb5845709d1a738543efbe77f66d729fe611847dbc500516d1e0
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL pointing to a domain associated with link farming and SEO manipulation, flagged by heuristics like PDF_SEO_LINK_FARM. ClamAV detection as Pdf.Phishing.Trojan indicates a malicious intent, likely to redirect users to a phishing or malware distribution site. The ML classifier also strongly suggests maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • PRC/3D content in PDF medium CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=polar+cylindrical+and+spherical+coordinates+pdf
    • https://cdn-cms.f-static.net/uploads/4446789/normal_5fd5f7b558330.pdf
    • https://sosojenanoxo.weebly.com/uploads/1/3/5/3/135316520/ab98b2755.pdf
    • https://juvuvekogowara.weebly.com/uploads/1/3/1/8/131856935/496456.pdf
    • https://static.s123-cdn-static.com/uploads/4455642/normal_5ffc7c3fe0a07.pdf
    • https://zitidatuviwe.weebly.com/uploads/1/3/4/4/134493200/8477587.pdf
    • https://cdn-cms.f-static.net/uploads/4458148/normal_605cc446161a4.pdf
    • https://cdn-cms.f-static.net/uploads/4449627/normal_601bb667921be.pdf
    • https://mufusudakewita.weebly.com/uploads/1/3/2/6/132681672/3747641.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3c60b21a-18c9-42d6-9878-5ab0c47fb805/ge_advantium_120_light_bulb_replacement.pdf
    • https://uploads.strikinglycdn.com/files/571317a3-6c35-44b4-943d-6a2d3f26fad1/symbol_scanner_programming_barcodes.pdf
    • https://uploads.strikinglycdn.com/files/dd1b9b55-363d-4695-b441-345ae1d384d3/dunananejumo.pdf
    • https://uploads.strikinglycdn.com/files/829589df-999d-4c80-8c36-66b6f146466e/74781492174.pdf
    • https://uploads.strikinglycdn.com/files/c3f10535-04dd-4c6e-a22c-921beba5a8a6/the_complete_green_letter_book_love.pdf
    • https://uploads.strikinglycdn.com/files/c18a5ad4-19fd-457c-b7e4-1f1f0fec4612/ademco_vista_128bpt_installation_manual.pdf
    • https://uploads.strikinglycdn.com/files/1142d58f-bd8a-4e49-9f3f-2d1dbee7f56c/tolumuju.pdf
    • http://zaramapowo.rf.gd/bestwap_kgf_ringtone.pdf
    • http://fizijumopib.rf.gd/los_medios_de_comunicacion_para_segundo_grado_de_primaria.pdf
    • https://uploads.strikinglycdn.com/files/05bb95cb-756f-43a4-a461-119798a396eb/14703068942.pdf
    • https://uploads.strikinglycdn.com/files/8c466d08-44ce-4b5a-a1dc-b22d02625fcc/dubegiminemukad.pdf
    • https://uploads.strikinglycdn.com/files/73e0a545-7d95-421c-874f-1cc206f9e47b/rosawa.pdf
    • https://uploads.strikinglycdn.com/files/a999b8a2-a89e-43f2-bef7-9437f82aa99a/gigulokategok.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001734b.bin
f808d6279b3c311f9b5bed60f7ac7a42b4d9e880079d69a33be1435c53830e2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1734B 5348 bytes
font_01_sfnt_off0001857d.bin
cace6bce5b2bc957e265c12345b3e840476471c1bf3cf6357d8e962ccd3fa959		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1857D 12924 bytes
font_02_sfnt_off0001b211.bin
b87aebdc6a0061de548b94b60e3f552094de6046318324cdc05edf5016ecf382		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B211 16620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.