Malicious PDF — malware analysis report

Static analysis result for SHA-256 25714f75373bf512…

MALICIOUS

PDF

88.5 KB Created: 2021-02-27 03:36:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 29f00d12caba45711a25e41cfeadc2ab SHA-1: 144d89de0cd8f192007e7ae05b1f3454f2710146 SHA-256: 25714f75373bf5124c10c0fba5962d5065efbbbde8905336386780e743d8cc12
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDFs, suggesting a link farm or redirection mechanism for malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. The embedded URLs are likely used to redirect the user to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=how+to+say+conflict+resolution+on+resume
    • https://static.s123-cdn-static.com/uploads/4484107/normal_6004871d5910d.pdf
    • https://cdn-cms.f-static.net/uploads/4426830/normal_6033b528a98b7.pdf
    • http://naturfresh.space/984099260264j8xp.pdf
    • https://cdn.sqhk.co/bemememu/gdkJLjb/ducks_basketball_roster_2016.pdf
    • https://static.s123-cdn-static.com/uploads/4428033/normal_5fed54ecbf6b7.pdf
    • http://afracheat6.xyz/391207665920b0pp.pdf
    • https://static.s123-cdn-static.com/uploads/4384149/normal_5fcd65110077c.pdf
    • https://xagaxomopezegif.weebly.com/uploads/1/3/4/3/134355140/09553ce936e9e.pdf
    • https://static.s123-cdn-static.com/uploads/4503533/normal_6004181d42270.pdf
    • https://fapopadiwa.weebly.com/uploads/1/3/1/4/131438416/nosur-mujimadatesak-xazusawi.pdf
    • http://mnclassis.org/wulisozeguvuzudtqfvq.pdf
    • http://lnstagramcopyrigtservice.com/bol_chudiya_bol_kangnasz3s5.pdf
    • https://static.s123-cdn-static.com/uploads/4449968/normal_5fc728f7ed75a.pdf
    • https://cdn.sqhk.co/nalujujoso/hcxrjhi/lufipuxezejusanifakega.pdf
    • http://winoraama.space/27502090539j8yiv.pdf
    • http://kigurumi.org/binakesepebuwosubtxc77.pdf
    • https://cdn-cms.f-static.net/uploads/4407084/normal_600ff2f2ade53.pdf
    • http://redtea.space/amor_divina_locuraa2w9n.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f84.bin
9f55c5bed885844a94ed0d7aab9d9f75267d5ce170b4720bcbdd7da2925172c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F84 5064 bytes
font_01_sfnt_off000120ae.bin
15e1efd44e34d3b3ef80c8c0d15d9c4101054811d85555c141a4b930550f36e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120AE 10844 bytes
font_02_sfnt_off000145e9.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145E9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.