Malicious PDF — malware analysis report

Static analysis result for SHA-256 241c848e2f8cdd44…

MALICIOUS

PDF

88.5 KB Created: 2021-03-22 16:47:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e670ef4f3ff68002b029705eeaea6df5 SHA-1: 98915916476ac8408f30e6c56c2c0567a2a96e8b SHA-256: 241c848e2f8cdd442eebd775f02b2575bf75eb17d3970d80dc3e81668818bb53
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, suggesting it is part of a link farm designed to distribute malware or phishing content. The document body, though heavily obfuscated, indicates it is presented as a 'biblical study' to disguise its malicious intent. No scripts were extracted, but the presence of numerous external URLs is a strong indicator of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=estudio+biblico+sobre+el+don+de+fe
    • https://cdn.sqhk.co/rixutixim/ied5OaR/go_karts_orlando_outdoor.pdf
    • https://cdn.sqhk.co/fexiseme/du55jj5/64127252498.pdf
    • https://zudejuzire.weebly.com/uploads/1/3/2/6/132681250/3393626.pdf
    • https://cdn.sqhk.co/xisiwuba/bJfZgf8/gudepixotizoduwufomafov.pdf
    • https://cdn.sqhk.co/vameduvide/gjzhcfo/65795562078.pdf
    • https://mesikanuxiruk.weebly.com/uploads/1/3/1/6/131636832/1fd15db4443db.pdf
    • https://cdn-cms.f-static.net/uploads/4367308/normal_602d2cbd5a184.pdf
    • https://static.s123-cdn-static.com/uploads/4447880/normal_5fdde12577e04.pdf
    • https://fejisamuzek.weebly.com/uploads/1/3/4/6/134636520/3719151.pdf
    • https://cdn.sqhk.co/jagapifa/Fhhihjf/lodagetoguwepalepebiwok.pdf
    • https://cdn.sqhk.co/savunowudob/jQ3Fphi/96752677110.pdf
    • https://cdn.sqhk.co/sowotewope/m0iePKI/buvogenerafolamixetunur.pdf
    • https://cdn.sqhk.co/sevafeluba/bij5xVn/road_trip_quotes_movie.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://45e41439-46a4-4c97-84f0-155cfeda4cef.filesusr.com/ugd/9d7ad9_2cda660c19954f9d8679594b379d359c.pdf?index=true
    • https://fab88ded-2f12-46c9-b6ec-f290036286cc.filesusr.com/ugd/cce69c_1d73734ffca548ef89b9564c472e5ff1.pdf?index=true
    • https://69cf8a46-0d3d-4b71-8fd1-93df925da18e.filesusr.com/ugd/e4064d_007d9572c7454605a499ac1af6146b0b.pdf?index=true
    • https://37e0f79d-b0c1-4727-b76d-5b759c81288f.filesusr.com/ugd/9c66ff_71a5706f98414944bffadb7cdd77c087.pdf?index=true
    • https://7f1158f2-e44e-4cac-991a-806210d1dc3e.filesusr.com/ugd/e4a8e1_daa136bf211e487298311baec71f53b1.pdf?index=true
    • https://edb7bb8d-792a-4213-93ec-7f573d37cc74.filesusr.com/ugd/bfd504_3d707f639d084662ae1de77641751a98.pdf?index=true
    • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_7b6bb149fd0f409dadc3b837ff1407ed.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107d8.bin
84f93dc2cd3702138d2ece5a71e584d305d8569e9576d0614da15239aa38e6b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107D8 4900 bytes
font_01_sfnt_off00011894.bin
8fe670e3be8cc7573800c41c77795424d410b140a94e6bf2fe1fa58c68f021d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11894 11924 bytes
font_02_sfnt_off00013fce.bin
2173a1880e9f774f759393e7d0d28dda91d04d8a3eae6bea41b822770b343b90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13FCE 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.