Malicious PDF — malware analysis report

Static analysis result for SHA-256 1209bb4b78651b37…

MALICIOUS

PDF

105.5 KB Created: 2021-02-21 23:22:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-29
MD5: 970157ff96f7beaf71c85afe586a4563 SHA-1: 0a1ff5fbbde784c6b47f817df245604e6da2beb4 SHA-256: 1209bb4b78651b37adcd5408322a3baae3be6a790f7f3b601536db1914b28784
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used in SEO poisoning or link farm attacks to drive traffic to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically phishing. While no scripts were directly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=best+easy+animation+software+free+download PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4419191/normal_5ff564cd73dcf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365607/normal_602a98e6574a8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451757/normal_601e1e04ad86a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445749/normal_5fdd86407e136.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381544/normal_5feb6c5b5d283.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454808/normal_6018782db8bf8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4376103/normal_5fdda00b38737.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421613/normal_602b345d61e26.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446287/normal_5ff0c45ee2500.pdfIn PDF document text
    • https://xufujume.weebly.com/uploads/1/3/4/8/134851049/vafasizebera-vepubemasire-mubakeba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372399/normal_603246a177a47.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402267/normal_5fecc20be654f.pdfIn PDF document text
    • https://gedesinikus.weebly.com/uploads/1/3/5/3/135323437/4181152.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jinotugiwomo/18617739043.pdfIn PDF document text
    • https://s3.amazonaws.com/rakabexozu/android_studio_view_logcat_window.pdfIn PDF document text
    • https://s3.amazonaws.com/juliziwojatige/bengali_sathi_movie_video_song_hd.pdfIn PDF document text
    • https://s3.amazonaws.com/lodazojamuva/napuvazaderegumewep.pdfIn PDF document text
    • https://s3.amazonaws.com/podawakumepewez/inner_mongolia_tour_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xijuxosisomuna/thermal_insulation_sheet_philippines.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000138a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138A2 5296 bytes
SHA-256: bbbc9084b27d78dd27ec9ae0b6b6823d0c55f931118dfd28bc1922eb4b19adb8
font_01_sfnt_off00014aa2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14AA2 4656 bytes
SHA-256: 5ea27441561a2265f15e148fc8a2827ebd78e7cd8f1bac8f727686208c56e8cd
font_02_sfnt_off00015c05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15C05 10856 bytes
SHA-256: 9db6f90260858408bd94cd336ad6f32ed39d0632e12a32103ccc171dfb883b11
font_03_sfnt_off00018125.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18125 16464 bytes
SHA-256: e586364abc28c376e7e36ef48531ad351e65293103e42fc450c224b746d709d8

Open this report in the interactive analyzer, or submit your own file for analysis.