Malicious PDF — malware analysis report

Static analysis result for SHA-256 19ca66c00f5a8ef8…

MALICIOUS

PDF

65.7 KB Created: 2021-04-05 19:45:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ca5e0ce10e0437c6b1b8d26ac02b81d SHA-1: 6f15cf2a438d2b3e5c0d44bd6f75b6a74e509660 SHA-256: 19ca66c00f5a8ef8d1dffd50124f043285b2ec089e3225223fc2eed9d572a82d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one specifically identified as a potential phishing lure. ClamAV and ML classifiers flagged the file as malicious, indicating a phishing or trojan threat. The presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' suggest an attempt to redirect users to malicious sites, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=central+payment+san+rafael+ca
    • http://zagodutaf.getenjoyment.net/4747196977.pdf
    • http://fuxozomuwuwiwe.22web.org/kidde_smoke_alarm_goes_off_once_then_stops.pdf
    • http://wumiwuzigimo.mywebcommunity.org/relationship_between_electricity_and_magnetism_is_known_as.pdf
    • http://kudusakepupa.sportsontheweb.net/film_storyboard_template.pdf
    • http://befotuke.mywebcommunity.org/diary_of_a_wimpy_kid_10-14.pdf
    • http://fizadote.22web.org/compare_medicaid_health_plans_in_michigan.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/638fe877-7636-4f77-a8ef-38616c12cab0/what_is_polar_or_nonpolar_solvent.pdf
    • https://3ff4c494-4984-418a-b709-7a5c611cca0a.filesusr.com/ugd/adbee0_7a7078a2fb70408c8f5b3a510a70e291.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c2d33b69-3d0f-4339-a031-399aa65591d8/zumelevixinewajejasopex.pdf
    • https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_644eb039ca0d4cd193be4d80169e1939.pdf?index=true
    • http://funegabupeg.rf.gd/donumapalib.pdf
    • https://486bfeb6-87d8-40a3-812f-3449909c9139.filesusr.com/ugd/81b904_3f707299df9544fe96c9967e44a50824.pdf?index=true
    • https://5a8aee2d-3d68-4c09-98ed-743c9c56d6fd.filesusr.com/ugd/460efe_bc1d4bfc086f4016b84d34f3fafaf314.pdf?index=true
    • https://d7ae471b-a447-437d-81b4-4e603f8679d9.filesusr.com/ugd/0a3240_780321fee90c46d8b32f0d1ee46fb4f2.pdf?index=true
    • http://satawakerexe.atwebpages.com/fumuvunupudadigod.pdf
    • https://6c8ebe11-725c-420b-823a-68bc39d02ad2.filesusr.com/ugd/3e87bf_58b34cbba96a4b169036034e69442c2b.pdf?index=true
    • https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_4b103d699dce4f32a0e2f10a4f5c22d7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5627a950-0a12-4eca-be8b-63bf3ce397f6/what_does_msm_do_for_your_hair.pdf
    • https://c78ffd2e-fc3d-4272-86ca-968d835fb7ad.filesusr.com/ugd/0f9ef0_081bc2e5719743be9cd2e6f0c41686d7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6837b51d-a9a8-490f-8a21-c20a6a9d4b32/dekogerof.pdf
    • https://uploads.strikinglycdn.com/files/1fb5e544-3e74-45b9-8b52-213494b18d88/how_do_you_say_would_you_like_a_cup_of_tea_in_french.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c3d8.bin
9936a07a4048c4fc6195be2d26874e1b0b5888e766292c7d6b8a481226203ae7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC3D8 5168 bytes
font_01_sfnt_off0000d55f.bin
2d765fc2f47679066b02ce98e93c2a52dbf23fd4a9dfd1b009a5ab2045130fa1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD55F 10152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.