Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a3a1119323b16be…

MALICIOUS

PDF

77.1 KB Created: 2021-05-23 02:04:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: aea511be550fd597f35d92302ffa38a2 SHA-1: 44b5c415ac8af2d4097c008c74b635db57853c44 SHA-256: 1a3a1119323b16be4743d7717bc1413d86a40a5423b1b430b2824a5a681742cd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to Weebly and Strikingly hosted PDFs, suggesting a link farm or SEO spam tactic. One prominent URL, 'https://baarspo.ru/strik?utm_term=ler+livro+50+tons+de+cinza+mais+escuro+online+gratis', indicates a lure for free content, likely a phishing or malware distribution attempt. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=ler+livro+50+tons+de+cinza+mais+escuro+online+gratis PDF link annotation
    • https://rofewonopanofav.weebly.com/uploads/1/3/5/3/135312507/4868177.pdfIn PDF document text
    • https://lotutomoze.weebly.com/uploads/1/3/4/3/134309944/4767871.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476758/normal_5fcc73f33e44a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380543/normal_604e5296e7926.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388627/normal_60307b8e00970.pdfIn PDF document text
    • https://nagugopusoz.weebly.com/uploads/1/3/4/6/134645600/8b56926.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377388/normal_601a2d805397d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459054/normal_60664ee22c3d3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/b18e0ed7-cff1-438c-b270-73f2935d199d/sex_and_the_city_samantha_short_man.pdfIn PDF document text
    • https://s3.amazonaws.com/kezemiradigu/pebofunuronefagedejafu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b74447e8-b5de-410b-8974-379a724ba62e/how_much_to_install_procharger.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1dd5068a-a73a-440a-bb50-53f6f835d903/22_clues_level_33_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c00672ca-12ab-4409-a050-a40f80d47830/kazadozazezugogizu.pdfIn PDF document text
    • https://s3.amazonaws.com/rumezo/79865252824.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b74b8ee4-3d09-418b-b5ef-c6acffa7d2c9/jaybird_x4_vs_x3_reddit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f436d1f-fff8-4c64-a918-1805c6b54b4b/dr_seuss_read_aloud_books_green_eggs_and_ham.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de30861c-1ce4-4207-ba3c-b2e731b61bd8/32465091502.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/79f19a40-a3c4-43d4-8f12-306e936cfdaa/98563448844.pdfIn PDF document text
    • https://s3.amazonaws.com/pivetuzadujo/javascript_interview_questions_and_answers_for_experienced_with_examples.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD5B 5456 bytes
SHA-256: 205b6ecd5142d49dad3626e33ef76a80dcafc99e599c4f8a1b42cbfa0263fe54
font_01_sfnt_off0000efe6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFE6 12860 bytes
SHA-256: 3ef4f9179d2567b582b60a583c20cf648fe53fd5344316bd193d668d1ce08610
font_02_sfnt_off00011692.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11692 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.