Malicious PDF — malware analysis report

Static analysis result for SHA-256 1966a9974765667f…

MALICIOUS

PDF

72.1 KB Created: 2021-02-19 22:39:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: b80e406f34efdc955aed92dee80b0897 SHA-1: eca91241ee0e666c6ab38e9db184328d3b3792f9 SHA-256: 1966a9974765667fbaf66fd43a63d4fae9f699ec86c26e9f5e20bf5ce3e5e9f5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to PDF files hosted on various domains, suggesting a link farm or SEO spam operation. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and numerous external links are indicative of a phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wb?keyword=simulation%20with%20arena%20book PDF link annotation
    • https://cdn.sqhk.co/xurajalijok/bhgcji3/fazibaresa.pdfIn PDF document text
    • https://cdn.sqhk.co/sixepatexup/GM3Sdge/zetadenuturi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4502268/normal_6017241b8ef38.pdfIn PDF document text
    • https://cdn.sqhk.co/wareberefiz/Hhajhih/fujatidogipoxulesib.pdfIn PDF document text
    • https://cdn.sqhk.co/zidexamuwela/cbignig/amazon_fire_tv_4k_stick.pdfIn PDF document text
    • https://cdn.sqhk.co/vesagivara/BNhgH7T/21904605507.pdfIn PDF document text
    • https://fobinoxibenor.weebly.com/uploads/1/3/1/4/131437242/jawulamawavigux_vejumejozom_vomori.pdfIn PDF document text
    • https://xujuwoxevosu.weebly.com/uploads/1/3/4/8/134896670/238287.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370059/normal_5fd67d3185224.pdfIn PDF document text
    • https://kemovovem.weebly.com/uploads/1/3/1/4/131408999/2999416.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4424951/normal_60011c7fdcfdd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489598/normal_5fdc6efca8462.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pazatuv/tagumukazixubof.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000daa2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAA2 5148 bytes
SHA-256: 69d147d29438f50d380e90074cde7d85b06d004dd3fa8b9f7e22b9f93418325a
font_01_sfnt_off0000ec04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC04 11808 bytes
SHA-256: 0236972ed848c83d7dfab3aa413ef3c8d9c6a9f6a7de3fc3153c0c82f41e771c

Open this report in the interactive analyzer, or submit your own file for analysis.