Malicious PDF — malware analysis report

Static analysis result for SHA-256 21783da904f1cca2…

MALICIOUS

PDF

126.5 KB Created: 2021-03-09 03:02:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2f4d1a8a26c79b5004905eb1f85dbb65 SHA-1: e18a3ec2433d0f5bdf8912f40fd1b886224bdc9f SHA-256: 21783da904f1cca20d16f6e1e15edf4be8a69e87cada4e57d71eeb7b8ec1b787
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and a machine learning classifier, exhibiting characteristics of a phishing or SEO spam campaign. The heuristic 'PDF_SEO_LINK_FARM' indicates the presence of numerous external PDF links, with one prominent example being https://a80c0318-1640-4d50-a016-df037fc402b9.filesusr.com/ugd/895bef_c104de0ed3ed40e6bfcf799e72e5b309.pdf?index=true. The embedded URLs suggest an attempt to direct users to potentially malicious or deceptive content, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=farmacos+aminoglucosidos+pdf
    • https://cdn.sqhk.co/pukazibat/v8Iivhf/41840106956.pdf
    • https://cdn.sqhk.co/wapuvalapowa/gjhvIjj/free_dating_sites_for_singles_over_60.pdf
    • http://rifeter.22web.org/fourier_transform_of_a_bessel_function.pdf
    • https://nikupotipemami.weebly.com/uploads/1/3/0/9/130969226/tikebisufefowapiz.pdf
    • http://moxumepavigotuf.iblogger.org/fevejuxoba.pdf
    • https://mepogazab.weebly.com/uploads/1/3/4/5/134501519/11aaff.pdf
    • https://cdn.sqhk.co/koxuzofu/gvheQIX/51306310978.pdf
    • https://cdn.sqhk.co/dedikunakudu/XChgigd/first_aid_kit_emmylou.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a80c0318-1640-4d50-a016-df037fc402b9.filesusr.com/ugd/895bef_c104de0ed3ed40e6bfcf799e72e5b309.pdf?index=true
    • https://s3.amazonaws.com/zesotat/96908244674.pdf
    • https://ee67c5b3-b4d3-4257-b425-af55881d3a68.filesusr.com/ugd/c60da7_b41097753ffa4acbbcd2ea4c9307f252.pdf?index=true
    • https://fccd5518-64e1-462d-9dbe-8d8d8a19ca7a.filesusr.com/ugd/eb005d_19d309b7fb7446b7a751fced72665ec3.pdf?index=true
    • http://dewonatazuji.epizy.com/pukovokirakexejevi.pdf
    • https://7a579b3f-ce96-4c66-abdc-991530493d29.filesusr.com/ugd/010c6b_5f79697a7bb94aab95e475abd3f6dc05.pdf?index=true
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_6cce63ccf11c42bb9b11a077f2d0ca38.pdf?index=true
    • https://6376acfe-5884-4251-b3d5-19a03c044549.filesusr.com/ugd/de3d83_5eb13ae3700f47529963cb4763ee4847.pdf?index=true
    • http://junonuzutivo.epizy.com/asus_rt-n12_n300_wifi_router.pdf
    • https://d4bcd744-2348-4fe3-9006-05b2fcbd3cbd.filesusr.com/ugd/704566_0bbb950ed3d9458ca83a5e890228760c.pdf?index=true
    • https://d4078116-a2d5-466f-97e6-20d899f6ca30.filesusr.com/ugd/576447_885d982d0ea4423a90478ffd23e5d8b9.pdf?index=true
    • https://s3.amazonaws.com/bivanud/gmail_android_app_black_theme.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000195c1.bin
4dc63cbfbaea7b4d6f01a753b5747bab07c0759bddc0bd0c1116b940755b5805		 pdf-font-stream PDF embedded font (sfnt) at offset 0x195C1 5432 bytes
font_01_sfnt_off0001a825.bin
a577ecee491c9112e5f3de8fb3d8b3820d9f966aeb745db609059a68354444a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A825 14956 bytes
font_02_sfnt_off0001d6e1.bin
ab88ee0552c0e3f63de41ce736f8b12df66eba36e00887189a948e70e29870c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D6E1 16196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.