Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d4bc6700e429625…

MALICIOUS

PDF

81.3 KB Created: 2021-01-14 07:20:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: bab8532d69c5461579a95a10203af7c0 SHA-1: 0d2aa4ff4e8bb0e01d3d4c0bc84016a38f9e128f SHA-256: 1d4bc6700e42962502fcbe6dc334863b8bb8858c686922b81999f63536edc9e7
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF document is identified as malicious by multiple heuristics, including ClamAV and an ML classifier, and exhibits characteristics of a callback phishing or tech-support scam. The document's content, though heavily obfuscated, is suggested by heuristics to be a "sick leave application letter pdf" lure. The presence of numerous external links, many pointing to other PDF files, indicates a link farm designed to distribute malicious content or host phishing pages. While no scripts were explicitly extracted, the PDF structure and embedded links suggest potential exploitation or redirection to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=sick+leave+application+letter+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4415534/normal_5ff41a635fb3d.pdfIn PDF document text
    • https://gumewixolasadaz.weebly.com/uploads/1/3/4/6/134659592/b88c2b701a55.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368240/normal_5f893867d9c9d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372355/normal_5fe59f0b9e085.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454161/normal_5fa5f4e525d64.pdfIn PDF document text
    • https://runuwafulisejet.weebly.com/uploads/1/3/5/3/135337902/7082314.pdfIn PDF document text
    • https://cdn.sqhk.co/sebudesusoj/ndidwsT/valgame_dios_capitulo_143.pdfIn PDF document text
    • https://site-1175554.mozfiles.com/files/1175554/46105960732.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471992/normal_5fd978aea4583.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387035/normal_5fb47f5ba3b11.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446636/normal_5fdc6000d375f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378164/normal_5fa366a1c3328.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4473645/normal_5fdbc401c8ea4.pdfIn PDF document text
    • https://site-1174029.mozfiles.com/files/1174029/66384009168.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102A1 5196 bytes
SHA-256: 6a4cad5de14a8da1704196fdb512506351a5e82f40522adb3604d62432dbd75c
font_01_sfnt_off00011471.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11471 10516 bytes
SHA-256: 88136a4f1943b976eb8e159a2481271772f7295e91e666e041bf0c91674ef89c

Open this report in the interactive analyzer, or submit your own file for analysis.