Malicious PDF — malware analysis report

Static analysis result for SHA-256 2027c945fdb13c04…

MALICIOUS

PDF

75.5 KB Created: 2021-03-17 20:23:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a617cfae3bf877d19d2d058f3b17a6f1 SHA-1: b451d73150b8954bc08624b3c91569c99ee72a51 SHA-256: 2027c945fdb13c04b6314d61a2ba588b433f36c7fbcb8de3ffc3cdac7d6cd91f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. It contains a large number of external links, suggesting a link farm or phishing attempt. The document body, though heavily obfuscated, appears to be a lure related to joining a PDF in Excel, likely to drive traffic to the listed malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=joindre+un+pdf+dans+excel
    • https://cdn.sqhk.co/nodujugebi/iPypgfq/old_computer_keyboard_connector.pdf
    • http://gufutaca3.xyz/qmp_board_dates4d10m.pdf
    • https://cdn.sqhk.co/detatakev/ejimyL6/proxima_centauri_b_temperature_in_fahrenheit.pdf
    • https://fafotarume.weebly.com/uploads/1/3/1/0/131069904/dd1dcc.pdf
    • https://nipixajivoru.weebly.com/uploads/1/3/1/4/131436983/36f129fa5280.pdf
    • https://cdn.sqhk.co/tatakakuwito/dI0GbAf/20434884145.pdf
    • http://trelon.fun/how_do_i_program_my_uverse_remote_to_my_tvjggnv.pdf
    • https://jojonawizofobu.weebly.com/uploads/1/3/1/4/131438175/ec942fea489c.pdf
    • https://cdn.sqhk.co/xeviremal/YiaZjf4/12vdc_cable_calculator.pdf
    • http://xozonline.ru/tetujirogarujerojujuvgovcq.pdf
    • https://cdn.sqhk.co/tinolefowi/rhjiggf/41405457078.pdf
    • https://giruwaferelesed.weebly.com/uploads/1/3/4/8/134850821/loguv.pdf
    • http://wowmarket.info/final_fantasy_tactics_war_of_lions_ps4rm4yu.pdf
    • https://govexofube.weebly.com/uploads/1/3/1/8/131872198/zowosawovetiwi_tugutux_mavilovamag.pdf
    • http://cardio-natural.info/roland_td6_drum_kit_for_saleucrwq.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://9526c93a-d340-4dca-b5fd-2864ff0888c4.filesusr.com/ugd/4c3d6a_c2ccfba15f7349abb8bc08aa93eaf469.pdf?index=true
    • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_5970c030134f4ec58ab40c90dcdb08b8.pdf?index=true
    • https://04fd4788-ed9c-4cd3-99f9-ca92bb8352cc.filesusr.com/ugd/8b97dd_40540964d13a41618b0f8cc1176ae5fe.pdf?index=true
    • https://488c2ff9-9ff4-499e-8f11-525115e20b22.filesusr.com/ugd/8aba0c_5bc98931a8874ae6b6420d09e74fdf26.pdf?index=true
    • https://ea64ff4c-51e6-4efc-8cc1-399682447901.filesusr.com/ugd/961f18_921b4c147e824cb592b4ce41d547a48c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e974.bin
4e27f2cf2cf426627e56f4dc8ff5face414b2cac2378be55a281d9b2ab82a404		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE974 5204 bytes
font_01_sfnt_off0000fb3e.bin
e18954174658f689cc7fc04732f433203612655d817e3ccdec4df53530b9ef05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB3E 11384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.