Malicious PDF — malware analysis report

Static analysis result for SHA-256 16e15369db65ec1c…

MALICIOUS

PDF

72.4 KB Created: 2021-02-20 11:24:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 3ab862c4bfde2bd399588c44c7b55ffd SHA-1: a894b798a3edf37db45052f5a61b204699a86ce6 SHA-256: 16e15369db65ec1c3c27afaef5f61409c1d597a1a1405c6133bb24d8070c7bfd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting a tactic to drive traffic to various websites. The presence of ClamAV detection and an ML classifier flagging the PDF as malicious further supports its malicious nature. While no scripts were extracted, the structure and numerous external URLs indicate a phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=outlander+diana+gabaldon+quotes PDF link annotation
    • https://sekojeti.weebly.com/uploads/1/3/4/5/134583019/a4ce9bf40b0959.pdfIn PDF document text
    • https://lirukasuk.weebly.com/uploads/1/3/0/7/130739032/dutimugu.pdfIn PDF document text
    • https://vogavowaxataner.weebly.com/uploads/1/3/4/2/134266619/23f7196.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374540/normal_6025f1f8445c1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374207/normal_6013055d6bef6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367313/normal_5ffd6947b5646.pdfIn PDF document text
    • https://vomerigovelaj.weebly.com/uploads/1/3/4/9/134901888/fb737e6b.pdfIn PDF document text
    • https://vimanofadubob.weebly.com/uploads/1/3/5/3/135304206/bikigilon.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sojenozap/kodibexoxosupoviwagujil.pdfIn PDF document text
    • https://s3.amazonaws.com/biwubeleba/d_d_3._5_character_generator_free.pdfIn PDF document text
    • https://s3.amazonaws.com/tuzamada/android_auto_vietnam.pdfIn PDF document text
    • https://s3.amazonaws.com/rudelazifizuvo/ordinal_numbers_worksheets_for_grade_3.pdfIn PDF document text
    • https://s3.amazonaws.com/zedudo/scope_of_employee_absenteeism.pdfIn PDF document text
    • https://s3.amazonaws.com/jupoti/56345272540.pdfIn PDF document text
    • https://s3.amazonaws.com/wupixufekijax/clickshare_quick_setup_guide_cse-_200.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE6C 5288 bytes
SHA-256: 7e557eab9b880c595b20666ed607989cd1611b1320fbae98d4ef9e0454560265
font_01_sfnt_off0000f05f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF05F 10772 bytes
SHA-256: 1e76ebfaad449aee4cd78864934bb4fa28be551d9c752bd3c113e4bce9063dd8

Open this report in the interactive analyzer, or submit your own file for analysis.