Malicious PDF — malware analysis report

Static analysis result for SHA-256 1037dbca943b6f9d…

MALICIOUS

PDF

78.1 KB Created: 2021-03-12 11:17:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a288f8a49e0d59a66d756ae9b5332d37 SHA-1: 257d49c000b0f2768e351c381c6be5bd2e8653c6 SHA-256: 1037dbca943b6f9dd5abc21c7478321855d689fa998f06a49113e8d05e809994
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ML classification and ClamAV, indicating malicious intent. It contains a large number of external links, suggesting a link farm or phishing attempt. The embedded URLs point to domains that are either unknown or have a suspicious reputation, further supporting the malicious classification. No scripts were extracted, but the PDF structure itself is used to host and link to external content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=pediatric+cardiac+catheterization+pdf
    • https://cdn.sqhk.co/fexiseme/NMihhfg/2020_election_prediction_map_update.pdf
    • https://cdn.sqhk.co/baxorurifina/ieidhjd/colonial_house_pros_and_cons.pdf
    • https://cdn.sqhk.co/veladaxuzeba/dOxfK4w/93308331698.pdf
    • https://cdn.sqhk.co/zanudiwageg/4dieFjd/kik_app_for_pc.pdf
    • https://static.s123-cdn-static.com/uploads/4422918/normal_5fc990702ec0b.pdf
    • https://static.s123-cdn-static.com/uploads/4421058/normal_5ff66d631eef2.pdf
    • https://cdn.sqhk.co/zunesunatiri/jghhNid/91090937648.pdf
    • https://static.s123-cdn-static.com/uploads/4472788/normal_6007b08431ed8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ff0b3df2-dc61-4aeb-9024-93fa9b5bc175.filesusr.com/ugd/aa14a9_1782bdcc69ac415384182dfd5a88b767.pdf?index=true
    • https://s3.amazonaws.com/jotogorurekuro/free_printable_college_math_worksheets.pdf
    • https://s3.amazonaws.com/zinudipir/liwamakimiv.pdf
    • https://s3.amazonaws.com/rakabexozu/assassin_s_creed_unity_android_ppsspp.pdf
    • https://s3.amazonaws.com/lejivugeleguwod/mac_os_json_formatter_command_line.pdf
    • https://s3.amazonaws.com/padadutiseni/83951833057.pdf
    • https://1cbf0fd9-62af-4102-a3dc-982f361539e7.filesusr.com/ugd/bfbc46_0b274166b6e847abafed132beccb33be.pdf?index=true
    • https://f803bf1b-e1c2-47f6-a41f-c9785c88fbd4.filesusr.com/ugd/bf07b1_91960eda541842838d6e60cb13a42ec4.pdf?index=true
    • https://s3.amazonaws.com/difigomisosak/79149670448.pdf
    • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_abeef7b03ac74798a97a7061897c55bd.pdf?index=true
    • https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_5f95facf2ac04baf8b408993dd89e9e8.pdf?index=true
    • https://s3.amazonaws.com/zufojadibi/athens_airport_flight_arrival_information.pdf
    • https://fa53e508-d88d-41cb-897c-7a5b6f1bfcc3.filesusr.com/ugd/361045_008a70c73d944dcdbaf0811d9cd9eeac.pdf?index=true
    • https://0c2a99dd-71fd-4a0d-b96f-672cfa785c21.filesusr.com/ugd/515c54_8b6f2ee484774e5d9026b9ae468745be.pdf?index=true
    • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_e6bb06abdec54ba78f9681562d8235e2.pdf?index=true
    • https://s3.amazonaws.com/polojuliragam/lokuzevezegizutalurov.pdf
    • https://s3.amazonaws.com/kisimujuk/35713794984.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f628.bin
05c97a2994a5f84dc345ff0c30f6662bf2ac42e2f6541b18584d34ed49bd13e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF628 5084 bytes
font_01_sfnt_off0001077b.bin
7c8e0243c0bf4fd25deeb2950bb40dc2c2e06871fd57ae5de564df8c96ab254c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1077B 10316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.