Malicious PDF — malware analysis report

Static analysis result for SHA-256 253d8867971b55e8…

MALICIOUS

PDF

67.8 KB Created: 2021-03-14 04:35:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a3d5d2388113e49761b65e96f4cd1086 SHA-1: df1a7f25d0ac42a2a74762d70539c2d4d8d0181a SHA-256: 253d8867971b55e8b795fe5ea9f1465f53ae499c6760bae81a89f3c286713adb
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains numerous external links, a common technique for SEO spam or phishing. The ClamAV detection and ML classifier strongly indicate malicious intent. The presence of a link farm and a call-to-action phrase suggests a phishing or malware distribution attempt, likely using a spearphishing attachment vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=company+profile+pdf+kenya
    • https://static.s123-cdn-static.com/uploads/4404515/normal_5ff97a72a5a5a.pdf
    • https://static.s123-cdn-static.com/uploads/4486351/normal_5fcdb4c6ab6c7.pdf
    • https://cdn-cms.f-static.net/uploads/4462345/normal_6034c18b26b5c.pdf
    • https://cdn-cms.f-static.net/uploads/4466398/normal_603874d83b2b7.pdf
    • https://cdn-cms.f-static.net/uploads/4392470/normal_60133a5626412.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bupesejirijejus/gigoma.pdf
    • https://3176e400-c268-4dc0-8d69-08eae86937f8.filesusr.com/ugd/ea2f88_e176433d850f4dcab01321526dc4bd0d.pdf?index=true
    • https://s3.amazonaws.com/rilexazejuzovep/blackjack_normal_font_free.pdf
    • https://s3.amazonaws.com/werowibovezoje/zeviget.pdf
    • https://44f68060-d5e3-4d58-b4e7-e3760392f352.filesusr.com/ugd/49488e_40eb302adab84a7a8de657572e048a97.pdf?index=true
    • https://d52aed46-be45-4f9b-8106-cf6fc7ee66c0.filesusr.com/ugd/b148e5_044b5392c5fe42f5b84a7254a0f06bb2.pdf?index=true
    • https://s3.amazonaws.com/zowejunef/lord_i_need_your_voice_lyrics_by_dr_paul_enenche.pdf
    • https://s3.amazonaws.com/jedadokuti/26283177510.pdf
    • https://s3.amazonaws.com/sitozi/lijefovisifolejulatew.pdf
    • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_925e3dbf798e4ffca7e7cef69ffdf290.pdf?index=true
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_c7c8416c2b3e4fa4a685daace56c0a2b.pdf?index=true
    • https://s3.amazonaws.com/jifedefujodu/what_are_the_various_objectives_of_hrm.pdf
    • https://s3.amazonaws.com/woxojuxafopuv/54315625453.pdf
    • https://9907981b-0bc7-4fd3-a434-169f7cdadf42.filesusr.com/ugd/575363_6828ce5e481e4d4aa39028bd1bba1bec.pdf?index=true
    • https://4a0f17ac-6ce6-4c05-9546-25c48d39d9f7.filesusr.com/ugd/cd79e3_fe87de7b775d44a9aa0f30b493d657fd.pdf?index=true
    • https://s3.amazonaws.com/sazixipame/guided_reading_books_level_f.pdf
    • https://s3.amazonaws.com/mubemutolewe/jolexo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ccb7.bin
d2bffd18df8629156da133a5b343373b3813d6c74c28fa00452f62330fc58609		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCCB7 5080 bytes
font_01_sfnt_off0000ddf4.bin
fc83e23a14317d94076de0d523168d959dc287fe43ba0dcd6e0a803fd33b0429		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDDF4 10132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.