Malicious PDF — malware analysis report

Static analysis result for SHA-256 22530b42be99f859…

MALICIOUS

PDF

79.0 KB Created: 2021-03-25 14:36:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ad592912b18e86a6b60794c7b20464e0 SHA-1: 5fb2011d5cabee7adf9d2951b728becc824b3899 SHA-256: 22530b42be99f859df86d6c1f65b8cb46ebd5fb6b7d78c997832f546b250ffc5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a malicious intent to redirect users. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. While no scripts were directly extracted, the PDF structure and numerous external URLs indicate a likely attempt to lead users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+to+load+samsung+dishwasher+dw80m2020us
    • http://dosijefa.mypressonline.com/74989189847.pdf
    • https://cdn.sqhk.co/mopewedote/jhoyqpp/lagu_hyuna_bubble_pop_mp3.pdf
    • http://guparob.mywebcommunity.org/dolor_del_nervio_ciatico.pdf
    • https://cdn.sqhk.co/zinazejoras/tiehibP/how_to_build_a_soccer_kick_back_wall.pdf
    • https://cdn.sqhk.co/gobuwovuv/hijkieI/strategic_marketing_planning_definition.pdf
    • https://cdn.sqhk.co/juvexafi/jcFljhQ/94121716272.pdf
    • https://cdn.sqhk.co/taxeseta/bshatYh/bubble_shooter_happy_pop_1000_levels.pdf
    • https://cdn.sqhk.co/kisesawaropo/fghhmhc/sudof.pdf
    • http://sakivometo.medianewsonline.com/40299275789.pdf
    • https://cdn.sqhk.co/xekejegixawo/9r3RJpX/driving_car_simulator_apk.pdf
    • https://cdn.sqhk.co/janurisu/hf77xhe/crossroads_mall_hours_portage_mi.pdf
    • https://cdn.sqhk.co/kimejijomaki/ajghhcC/fenobaxizavatijef.pdf
    • http://jidokove.scienceontheweb.net/advanced_engineering_mathematics_by_rk_jain_srk_iyengar_solutions.pdf
    • https://cdn.sqhk.co/sawijewabob/iA3hdjc/45776026541.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7e6b698e-d56f-4a21-8c48-787e2f6d39f4.filesusr.com/ugd/7836c9_018772b8ad564aa8ae0527c611714f21.pdf?index=true
    • http://natukifuza.atwebpages.com/gilomusizozifupofeviz.pdf
    • https://eee7329a-c4d5-4508-a8fd-a8ba515f7d9f.filesusr.com/ugd/5ed802_4a0ef86332e74574a4bf9273167ceb2e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cb05ec0e-39db-43cb-8c6d-ea7691a4fc33/what_is_the_lowest_calorie_item_at_burger_king.pdf
    • https://uploads.strikinglycdn.com/files/dbcd6c97-cf15-4925-a2bc-61c6710b7e59/fezuzepenuxesinomipiva.pdf
    • http://sijadogif.atwebpages.com/batch_convert_html_to_text.pdf
    • https://98e80eac-0673-4bf9-a3de-4132461903b3.filesusr.com/ugd/1acd69_76742ce1d8a840d2848f61cef5f8245d.pdf?index=true
    • http://liraperuwuw.atwebpages.com/basic_english_grammar_book_for_competitive_exam.pdf
    • https://uploads.strikinglycdn.com/files/9df68b62-20f2-46ec-b83c-0c996c5d468d/the_man_in_the_high_castle_review_metacritic.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f71c.bin
a1a1a40dcafc2f077f25b9c9989d9b4a8420acb72410004b6e39e80645699ea9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF71C 5760 bytes
font_01_sfnt_off00010a98.bin
3fc9314fddaa66ff88ffe9d265dca3136b4f1d3e6ce3a29159a548fb90fde47f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A98 10336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.