Malicious PDF — malware analysis report

Static analysis result for SHA-256 257b596d5126972d…

MALICIOUS

PDF

82.4 KB Created: 2021-03-24 23:08:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eb04f9d0dbc0b5907626de1aa864b3be SHA-1: 9d3a83d653d2ccdeb340227f5fa176868c8c4538 SHA-256: 257b596d5126972d7da964c9e83579bfef365ee0944237b36e92315ad992a356
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, a technique often used for SEO farms or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically classified as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded URIs suggest it's designed to lead users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=strength+exercises+at+home+without+equipment
    • https://cdn.sqhk.co/jiwonukunav/iXiciby/85430080061.pdf
    • https://cdn.sqhk.co/romilononove/chaHjia/17527965631.pdf
    • https://cdn.sqhk.co/pirasemofoge/dic8ijd/dunk_line_advertisements.pdf
    • https://cdn-cms.f-static.net/uploads/4408343/normal_60247502edeba.pdf
    • https://cdn-cms.f-static.net/uploads/4477387/normal_6035d302675d5.pdf
    • https://cdn-cms.f-static.net/uploads/4369502/normal_6047b39f8fee2.pdf
    • https://cdn.sqhk.co/dexasubu/iXjjz1v/24762713536.pdf
    • https://cdn-cms.f-static.net/uploads/4494888/normal_601b8fd72a88e.pdf
    • https://static.s123-cdn-static.com/uploads/4490539/normal_6003a85e950ee.pdf
    • https://cdn-cms.f-static.net/uploads/4404313/normal_6027be5087c58.pdf
    • http://vuwimoxit.mygamesonline.org/skf_thrust_ball_bearing_catalogue.pdf
    • https://cdn.sqhk.co/sebixodof/hihVjdW/55922611187.pdf
    • https://cdn-cms.f-static.net/uploads/4417652/normal_6027473a9d234.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_78c30c929ce9437d9125096ef912e37e.pdf?index=true
    • https://s3.amazonaws.com/zagapaxa/mortgage_loan_commitment_letter_template.pdf
    • https://1a6c606f-1efd-495f-9370-57f425d809fd.filesusr.com/ugd/1be480_d6d810891aa7420abf3ab303144d86bd.pdf?index=true
    • https://s3.amazonaws.com/lolijexejomak/samsung_top_10_android_phones.pdf
    • http://duziroro.myartsonline.com/phonetic_alphabet_canada.pdf
    • http://bepolujogox.atwebpages.com/3531390246.pdf
    • https://s3.amazonaws.com/wesezuzuvalirik/vusamaxugexukorimitefen.pdf
    • http://kamigawox.atwebpages.com/quick_emotional_intelligence_test.pdf
    • https://eee7329a-c4d5-4508-a8fd-a8ba515f7d9f.filesusr.com/ugd/5ed802_6410ef20e8f1448e91cbfc382637b968.pdf?index=true
    • https://s3.amazonaws.com/tuxutedi/vimala_alphabet_font_free.pdf
    • https://s3.amazonaws.com/juzewojavomofew/xokafekemi.pdf
    • https://8488b7ac-84bc-45ae-88ed-26841205fc59.filesusr.com/ugd/7cda3c_156f000602814e34a5479be6101d1d85.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000104d0.bin
33328867f46e5b39ef0c1eff5833aefe4e010ccb9ff86abc5066d4200e074a37		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104D0 5704 bytes
font_01_sfnt_off00011830.bin
1e8d296f2e126146a164da604c9d050ea79d8f8b616affd3ff564c9969d90c62		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11830 10432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.