Malicious PDF — malware analysis report

Static analysis result for SHA-256 19a20985ccd5cca9…

MALICIOUS

PDF

81.0 KB Created: 2021-04-04 22:16:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 447dbaf62ac58b7ae2c2e579c3d54967 SHA-1: e8c5f847ac1a9c74863f316b25270fb54b4ad831 SHA-256: 19a20985ccd5cca9ad503daa808d34d63b9f0d86935060ca4e8fd9096a0bd275
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, many of which are likely part of a link farm, as indicated by the PDF_SEO_LINK_FARM heuristic. One of these links, https://soxebez.ru/123?utm_term=cave+days++full+version, is flagged as unknown reputation. The ClamAV detection and ML classifier strongly suggest malicious intent, specifically related to phishing and potentially delivering a Trojan. No scripts were extracted, but the overall structure and heuristics point to a malicious document designed to deceive users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=cave+days++full+version PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/786cd953-8001-4c90-9921-92c3d9a37b5b/2006_toyota_prius_repair_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/navoburarovada/juvatek.pdfIn PDF document text
    • https://704d67de-a0ba-412a-a77d-f8c4cf0d88a3.filesusr.com/ugd/a83d94_366bd44579074c0e85dd12993cc82b73.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vaxebisapesi/54323517283.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20a668bb-a8d0-404a-a238-9c883abe545b/can_you_make_car_decals_with_cricut_explore_air_2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1cf5834-735c-4211-aa61-adbe9c36204a/identidades_trigonomtricas_ejercicios_resueltos_faciles.pdfIn PDF document text
    • https://75e6d08a-b14f-4c2c-bd4e-3e6431d9d11c.filesusr.com/ugd/497a87_efcfe9af891340268901ddd07952718c.pdf?index=trueIn PDF document text
    • https://9e705916-5bde-4eb8-be9b-8b3e910fbaf8.filesusr.com/ugd/c7a620_c68d1f612d9e4d35982aceafd9948804.pdf?index=trueIn PDF document text
    • https://cb70cc59-2297-49c3-b7e2-2ac7e26e28d4.filesusr.com/ugd/4479ed_27c5f637488a4fa4b938854ed07f4fa2.pdf?index=trueIn PDF document text
    • http://latodunakajof.rf.gd/adjectif_qualificatif_exercices_cm2.pdfIn PDF document text
    • https://s3.amazonaws.com/samopakamefap/camera_remote_shutter_android_app.pdfIn PDF document text
    • https://36fc1fe3-b646-4cc1-b6e9-de51469aea27.filesusr.com/ugd/3eb4bd_d31246676d994e5b8da67fedb87150f2.pdf?index=trueIn PDF document text
    • https://e8f98835-b194-42a5-b43f-fe2f29920dd6.filesusr.com/ugd/bf650e_e7cbbafbffc2419882f20c0f6c3dad7c.pdf?index=trueIn PDF document text
    • http://biwewija.rf.gd/tapabinelokajidiza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b3b5fba-855b-449e-9519-a86d2f5975f1/96822620705.pdfIn PDF document text
    • https://869e45c2-9c2d-410b-ad52-4d3411d41339.filesusr.com/ugd/73bd41_8ea3e0ccedf744b8abc305311a4ac3f5.pdf?index=trueIn PDF document text
    • http://sujosivetobifir.epizy.com/automatic_transmission_sensors.pdfIn PDF document text
    • https://89d9876f-4e47-4433-ab5b-8da47ae3ae5c.filesusr.com/ugd/37c326_2c053f936539461abb3883883b99c440.pdf?index=trueIn PDF document text
    • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_7f30ce03216f4de0b3a08f2c9059104e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2edc4df7-0370-4c34-8224-afbbebd244fe/pentair_easytouch_8_control_board.pdfIn PDF document text
    • https://s3.amazonaws.com/jopomodilamego/39869857900.pdfIn PDF document text
    • https://s3.amazonaws.com/bugutaj/73313473860.pdfIn PDF document text
    • https://fa53e508-d88d-41cb-897c-7a5b6f1bfcc3.filesusr.com/ugd/361045_85fdce0dc5ed41c88d998db074fdedf1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nonipesikiri/30185931307.pdfIn PDF document text
    • https://s3.amazonaws.com/kegubinefuda/mandatory_reporting_iowa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e505.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE505 4888 bytes
SHA-256: 2a349054491535fefc36b1168a466ce309b31ed0e2d4b9a73a4e87d84220a366
font_01_sfnt_off0000f5b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5B9 20964 bytes
SHA-256: a4a68c114c1eeb37081e35063b399b5d40eb84a2ec4f4f34d31111444e86d4a1
font_02_sfnt_off00012863.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12863 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.