Malicious PDF — malware analysis report

Static analysis result for SHA-256 21d10a6460947b41…

MALICIOUS

PDF

58.8 KB Created: 2020-12-01 20:59:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: df2751db899b2001b6ccbb8327211b5d SHA-1: 7d44c0d08874f035d38e4f440ee01ff6e25c1423 SHA-256: 21d10a6460947b414558953a11ab3eac48edad1f4acf7479c0850a8265567bec
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains numerous external links, with one prominent URL pointing to a site that appears to be part of a link farm, suggesting a malicious intent to redirect users. The heuristic 'SE_CALLBACK_LURE' indicates the document may also be designed as a callback phishing lure. ClamAV detection and ML classification strongly indicate maliciousness, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=focusing+on+ielts+listening+test+1+answers PDF link annotation
    • https://masudokunu.weebly.com/uploads/1/3/4/7/134731157/renabezibifu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc0bcfb2e537a05ef083615/t/5fc0fbbb3f75b16643f719ae/1606482876631/micro_and_macro_economics_similarities.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0ecedbf71053ccb1052a5/t/5fc1e1583570fb44d1473ada/1606541657581/87890056177.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc13d0827a199023ab79d37/t/5fc280754e98326c02618d48/1606582390323/jevexusig.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2284180-b440-498b-9e62-7908054478e2/97920008072.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6532986e-b023-49d1-ab8e-c9452487f0f2/69209191675.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23f16db3-799f-412e-af81-3adbc2448f27/vegemevabitexo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/203ebea6-c34e-483f-bf2c-f7febe2bfc70/how_to_recover_deleted_photos_from_google_photos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cf26efa-18a4-4327-8150-56cea2ffbedf/mama_exo_mp3_song_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0517a0f0-dc69-4a60-a136-06e263c408b9/35088146054.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ac7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAC7B 5068 bytes
SHA-256: 09f8910f0142f4f6dfdc111bcdda42ae022d5a49a1eefdf2735b83031b2b3e9a
font_01_sfnt_off0000bde2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBDE2 9644 bytes
SHA-256: 577e23062a0ebeae578a81515cea83b22f9e23f94872d07a5e59b7e097c0dfb2

Open this report in the interactive analyzer, or submit your own file for analysis.