Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a3aa5b9c246d6b7…

MALICIOUS

PDF

74.9 KB Created: 2021-02-19 10:47:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: 6723e788ea7ba379f59cb22b3887bf71 SHA-1: a41b279c27e6cfba8e562b228f9c9bc986ab4619 SHA-256: 1a3aa5b9c246d6b74f44aee1e469aca74538fc3ba3d23a244c2eb4a7658fa63e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are dynamically generated and point to potentially malicious content, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier and ClamAV also flagged this PDF as malicious, specifically as a phishing trojan. While no scripts were directly extracted, the presence of embedded URLs and the overall structure suggest an attempt to redirect users to malicious websites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=half+life+practice+worksheet+answers+pdf PDF link annotation
    • http://jurelireroxux.22web.org/93082590333.pdfIn PDF document text
    • https://cdn.sqhk.co/tinulafi/AidRDgd/yellowstone_cast_season_3_tater.pdfIn PDF document text
    • https://naxaletuzo.weebly.com/uploads/1/3/4/5/134508506/puturel-rosobuliri.pdfIn PDF document text
    • https://cdn.sqhk.co/ruwonumatag/Cjdnejc/leadership_skills_development_module_1_dba.pdfIn PDF document text
    • https://pidofuvu.weebly.com/uploads/1/3/0/7/130739764/38261098c46a8c4.pdfIn PDF document text
    • https://lubozukutiximik.weebly.com/uploads/1/3/4/4/134472848/famafubok.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jukoxisojow/92253789804.pdfIn PDF document text
    • https://s3.amazonaws.com/satulibaren/answering_service_for_plumbing_companies.pdfIn PDF document text
    • https://s3.amazonaws.com/legipalofi/59974425094.pdfIn PDF document text
    • https://s3.amazonaws.com/rudelazifizuvo/journal_citation_reports_science_edition_thomson_reuters.pdfIn PDF document text
    • http://mekavebij.epizy.com/96871909923.pdfIn PDF document text
    • https://s3.amazonaws.com/sazixipame/chronometer_android_get_value.pdfIn PDF document text
    • https://s3.amazonaws.com/miwolezedubujoz/hypothetical_interview_questions_and_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/jedaxopopuko/loan_officer_business_plan_template.pdfIn PDF document text
    • https://s3.amazonaws.com/winumigutam/verbace_arabic_dictionary_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/supefujoxopubu/jarituxinebug.pdfIn PDF document text
    • https://s3.amazonaws.com/dufekifaral/how_to_reset_ink_level_epson_l355.pdfIn PDF document text
    • http://pepukogabam.rf.gd/mortal_engines_shrike_explained.pdfIn PDF document text
    • http://ruxuwidoke.epizy.com/28990792296.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e821.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE821 5360 bytes
SHA-256: 2bedae946faad33e40fd6eb87a0181877e445bb82d01c5e4638f6f62ab63fb50
font_01_sfnt_off0000fa69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA69 10424 bytes
SHA-256: cf20dd9bad08ab0bd424653303d76437d43a457d93a6555a4871263c265307f5

Open this report in the interactive analyzer, or submit your own file for analysis.