Malicious PDF — malware analysis report

Static analysis result for SHA-256 194a75498619c39e…

MALICIOUS

PDF

73.8 KB Created: 2021-03-09 22:53:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90de56909e2d0a4a85133ccbfe6caf09 SHA-1: 07a5e8177deee337a1dea57f589dbf58aff48a2c SHA-256: 194a75498619c39e8692890a853f607d701c276810453122925a9d1b5a3368f2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are part of a link farm, suggesting a malicious intent to redirect users. The ClamAV detection and ML classifier strongly indicate this is a phishing or malware distribution document. Although no scripts were explicitly extracted, the presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' point towards a malicious redirection or download attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=calculo+de+centroides+de+figuras+compuestas+pdf
    • https://wojaginobaxap.weebly.com/uploads/1/3/1/8/131857211/783354ec.pdf
    • http://blancly.xyz/dreamcast_bios_retroarchpl4sg.pdf
    • https://cdn.sqhk.co/pasezateda/ij3iAkg/my_talking_ginger_2_apk_mod.pdf
    • https://vomizovuzib.weebly.com/uploads/1/3/1/6/131637161/f4bdbac3fb4.pdf
    • https://cdn.sqhk.co/gixelotopa/ijmL87Y/vikings_schedule_2020.pdf
    • https://cdn.sqhk.co/gojelonub/gdKNfih/dj_player_pro_app.pdf
    • http://zitugaxusi.mygamesonline.org/47974928443.pdf
    • https://taxezuwijukiwum.weebly.com/uploads/1/3/1/6/131606901/telezowojoruzeja.pdf
    • https://cdn.sqhk.co/xevowuto/hieROgj/package_inc._free_download.pdf
    • https://powirubojeti.weebly.com/uploads/1/3/1/4/131482959/rabakinazibule.pdf
    • https://cdn.sqhk.co/ravuviwidi/63hcjfF/booyah_recipe_wisconsin.pdf
    • http://hustlinmoney.com/mastering_concurrency_in_python8mdl7.pdf
    • https://cdn.sqhk.co/wekaradukuve/NfHoIhf/age_of_myth_genesis_review.pdf
    • https://cdn.sqhk.co/kiribikiv/iidMfgc/footsies_rollback_edition_online.pdf
    • https://cdn.sqhk.co/wodabumamuv/ijgzPjh/13208631830.pdf
    • https://fotinodonana.weebly.com/uploads/1/3/4/6/134692009/a237d219b473.pdf
    • https://babinekisifuve.weebly.com/uploads/1/3/2/6/132696104/gezetizov.pdf
    • http://p-kavkaza.ru/47396916291ssk8k.pdf
    • https://cdn.sqhk.co/lukedivibeb/jhb02Mr/vironatuluxezovoxu.pdf
    • https://tidatulo.weebly.com/uploads/1/3/2/8/132815220/1650b7b014fd.pdf
    • https://pimazapodozem.weebly.com/uploads/1/3/2/8/132814260/janekarudux.pdf
    • http://gromstroy.com/zelowoxefepogepuzigyy18j.pdf
    • https://jerupixudenaxi.weebly.com/uploads/1/3/1/4/131437293/5370985.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nijarigu.onlinewebshop.net/woxunowidilosetazotem.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df62.bin
31597df015c118b6cd909b1ce82043d0ae8f0553503379b7c0458414d58cebaf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF62 5380 bytes
font_01_sfnt_off0000f194.bin
1608d625e6a8abd5f0ca160490100918df7332b5332702ee5e51884d280f9fc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF194 11740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.