Malicious PDF — malware analysis report

Static analysis result for SHA-256 21bc47622d8c9ecf…

MALICIOUS

PDF

69.5 KB Created: 2021-03-19 09:26:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90d6a0be7418be8b5a4817fbb0966656 SHA-1: 2d326a98089fa350f42775e3839f3573e8d7f450 SHA-256: 21bc47622d8c9ecf1f976b3615e9cb57f27d268232348c1cfd5b8baf74794e0d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to suspicious domains, indicative of a link farm or phishing campaign. ClamAV detection and ML classification strongly suggest malicious intent, specifically identified as a phishing trojan. The document body, though heavily obfuscated, appears to be a lure related to 'solar energy', likely to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7937

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=definicion+de+energia+solar+pdf
    • http://parhelifrl.space/64245360056ma04.pdf
    • https://latobebesat.weebly.com/uploads/1/3/5/9/135993630/letapariso.pdf
    • http://esplus.pro/xikejolev1zlk.pdf
    • https://telozigigozato.weebly.com/uploads/1/3/4/3/134310186/450714.pdf
    • http://lamaded.mywebcommunity.org/bawawasolajijidodaz.pdf
    • http://itanah.space/88558447372k5jso.pdf
    • https://jaxuwigoba.weebly.com/uploads/1/3/4/2/134266140/dexezerepuselajafo.pdf
    • http://lianhua.life/81211794859vy0zu.pdf
    • https://nezododirexu.weebly.com/uploads/1/3/0/8/130813510/pomopukinov.pdf
    • https://bokowamimufap.weebly.com/uploads/1/3/2/7/132712050/wisuzukepasoje.pdf
    • https://xaleratugigajij.weebly.com/uploads/1/3/4/6/134631249/09d670.pdf
    • https://wadoruzog.weebly.com/uploads/1/3/1/3/131379034/jirokozi.pdf
    • https://bapumuper.weebly.com/uploads/1/3/1/1/131164114/dagelel-lunuw.pdf
    • https://fezekisovo.weebly.com/uploads/1/3/4/6/134661064/9485565.pdf
    • http://nakanilo.club/what_is_the_theory_behind_wheat_bellyf78nl.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fufudaloxola.onlinewebshop.net/defapuketulene.pdf
    • http://vilepobafomunow.atwebpages.com/char_broil_infrared_grill_ribs_recipe.pdf
    • http://tonizixezapomi.rf.gd/what_is_yoga_as_per_bhagavad_gita.pdf
    • http://mafuwiwoxosom.rf.gd/family_tree_maker_companion_guide_coupon.pdf
    • http://pasifowon.atwebpages.com/navicular_syndrome_in_horses.pdf
    • http://koduwutuvage.onlinewebshop.net/50264707270.pdf
    • http://nabesazuxipuf.epizy.com/birches_head_academy_uniform.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e931.bin
58d17695903bc883112da313878abe422ca5691baf0d5bea0c650873005145d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE931 5320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.