Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b2623fff27c7fd0…

MALICIOUS

PDF

69.4 KB Created: 2021-04-03 14:47:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cf435c273ef3b64b2785a30d2c25c2f2 SHA-1: bf0cd1c08f922c479a5b754a62972a7bf5c8dad8 SHA-256: 1b2623fff27c7fd0e6cbd7bede6da7b64f1a03728006c3423d73bbf7c3dbecb7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which point to suspicious domains, indicating a link farm or phishing attempt. The ClamAV detection and ML classifier strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware distribution scheme, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=rainbow+guide+service
    • http://strahuemsya.info/physics_ncert_solutions_class_12_chapter_11y5fkd.pdf
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
    • http://revershjtb.site/citizen_watch_eco_drive_manual_8700caxns.pdf
    • http://businesslinecenter.com/canon_pixma_mx922_support_code_b200pi230.pdf
    • https://cdn.sqhk.co/soxemudu/jitSNhi/atv31_user_manual.pdf
    • https://cdn.sqhk.co/jawutuwek/njgfhh7/regency_theater_the_plant_movie_times.pdf
    • https://cdn.sqhk.co/gopepilexafi/iemhaWd/cheerleader_dance_off_squad_of_champions_games.pdf
    • http://50offshop.info/machinerys_handbook_30th_used2pq40.pdf
    • https://cdn.sqhk.co/gikunixa/oxgc6jf/23038394045.pdf
    • https://cdn.sqhk.co/seworani/iaidhj1/flat_world_map_minecraft_seed.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/32b28b29-d908-46d0-a9bc-b2a87ee5a9ff/06.04_food_in_hispanic_cultures_writing_assignment.pdf
    • https://uploads.strikinglycdn.com/files/b3b5b6f6-224d-44b8-b9f3-3238c0092f3c/what_does_dystopian_novel_mean.pdf
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_a21321a206fb45bc8592efc7280e9d37.pdf?index=true
    • https://979cd01f-16ea-4d2c-b189-234964c95597.filesusr.com/ugd/d4c4cf_cce7dd0b844d4246884a515798753c59.pdf?index=true
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_0f05ff29fa2c4a0dbfe7e498addeff84.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c93e78c6-0510-4dc3-b948-42e27d383937/sejafafubonufi.pdf
    • https://6f2fb29c-15f2-4b08-b525-3eb91a7f0a41.filesusr.com/ugd/c3548c_b322a30972d841989785775f8f4c2e16.pdf?index=true
    • https://a7176590-a44a-43b4-8b25-1171fb6190ac.filesusr.com/ugd/e6ccb8_20c561e6f4e24a38aa27390ffd4d23cb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0eea6ca9-3c4a-477e-b2fd-5512fe24134e/michael_hampton_figure_drawing_free_download.pdf
    • https://5a98ae10-8c7e-48da-b83f-9bcbc644cfa3.filesusr.com/ugd/9a8764_c99d8eeeeb324c43afd1299a533a53ff.pdf?index=true
    • https://6754c94d-8795-460a-880d-d127bb37d4d4.filesusr.com/ugd/2383dc_3b7c7b4c47924c2695b0e705772ed0bb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/69e70769-2d13-4065-8395-4c67a10feebb/what_are_the_effects_of_human_activities_on_environment.pdf
    • https://uploads.strikinglycdn.com/files/cf7ebc6e-4f61-40a5-b92d-2fc0ef90c04a/evenflo_chase_booster_car_seat_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d23e.bin
dc29d4df0beb7afde27e8b366504250d9e5d7358c45e2d49ba7c5f14f5d0e7c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD23E 5372 bytes
font_01_sfnt_off0000e4b0.bin
46eb8f9f03e0f0b25b5b57f55483f2d56b58852093abcec99593002a8262a4ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4B0 10484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.