Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c78bbe64a460db0…

MALICIOUS

PDF

79.3 KB Created: 2021-03-17 03:04:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 04648fe5459e277852cb9e1325651c08 SHA-1: 277901a414f9f32d92406472dcaac1ec3a4c4ea1 SHA-256: 1c78bbe64a460db0b27f07e1acfc8f460c61ae679e3de4f555a469a0e6ed1436
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document is flagged as malicious by multiple heuristics, including ClamAV and an ML classifier. It contains a large number of external links, characteristic of a link farm, and the 'SE_CLICKFIX' heuristic indicates it attempts to trick the user into executing commands. The embedded URLs suggest a phishing or malware distribution attempt, likely disguised as a document converter.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=all+documents+to+pdf+converter+free+download
    • https://dosasefezopalan.weebly.com/uploads/1/3/1/3/131398547/6801374.pdf
    • https://kozinawesi.weebly.com/uploads/1/3/3/9/133997283/pizesufigafukex_motokabo_ligimer.pdf
    • https://jarowezib.weebly.com/uploads/1/3/0/8/130813985/rokavegapo.pdf
    • https://dagakaxogofawi.weebly.com/uploads/1/3/4/6/134699425/1799506.pdf
    • https://zidadosivifaju.weebly.com/uploads/1/3/0/7/130775619/vutulebixi.pdf
    • https://jawifeguviweti.weebly.com/uploads/1/3/2/3/132302916/4841267.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/zoromexemuzid/2011_mazda_3_owner_reviews.pdf
    • https://cf336f9a-6a79-4542-9269-5b62d6eb69dd.filesusr.com/ugd/1daf83_b028728b2bbf43e0baf92e6fcdadfe56.pdf?index=true
    • https://s3.amazonaws.com/gixirojozogufux/ibpsguide_monthly_current_affairs_quiz.pdf
    • https://s3.amazonaws.com/turip/ayenge_yaad_tumhe_satyajeet_song.pdf
    • https://s3.amazonaws.com/tugumeb/56044811132.pdf
    • https://s3.amazonaws.com/fefurorobumi/define_campaign_finance_reform_in_government.pdf
    • https://s3.amazonaws.com/jaloto/simple_biology_questions_with_answers.pdf
    • https://s3.amazonaws.com/pisik/why_wont_my_epson_wf_2540_printer_print.pdf
    • https://s3.amazonaws.com/nitizobuv/genie_model_acsd1g_manual.pdf
    • https://f98f40d2-b649-4e6b-99af-b89bbf2331ff.filesusr.com/ugd/724bd4_1ed0236ab14d49379157a0b7878ad1e8.pdf?index=true
    • https://s3.amazonaws.com/woberiz/nixizuxomonemorobusuzip.pdf
    • https://s3.amazonaws.com/fejenijovekozu/cloudformation_appsync_pipeline_resolver.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eba0.bin
b317294ee8c38de33c21ffaee4d6e379f92fc8ac2916f8641ba73c7e26c44306		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBA0 5276 bytes
font_01_sfnt_off0000fd86.bin
7557ac49bc41770244f351a0e9de0a7f4792e578544890f62f8b1888a68663cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD86 10600 bytes
font_02_sfnt_off000121b4.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121B4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.