Malicious PDF — malware analysis report

Static analysis result for SHA-256 2add9b7c303bbf7c…

MALICIOUS

PDF

77.1 KB Created: 2021-03-30 23:30:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0bbd331b1699abd0a62b729aa4eb4019 SHA-1: 563cbd30a067b38d0f9f4fb4e5f1220d608a8bb5 SHA-256: 2add9b7c303bbf7c2364813b3d2f68b6cb3589363564806bce1ca90ae952e7c7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used in SEO spam or phishing campaigns to drive traffic to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded links suggest an attempt to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=minecraft+windows+10+edition+maps
    • http://stebsmeh.space/rewrite_the_stars_instrumentalksncx.pdf
    • https://static.s123-cdn-static.com/uploads/4458849/normal_6003d7b9b87f2.pdf
    • https://cdn-cms.f-static.net/uploads/4472503/normal_603b1e8470090.pdf
    • https://cdn-cms.f-static.net/uploads/4378834/normal_60217d30cdc8b.pdf
    • https://cdn-cms.f-static.net/uploads/4390383/normal_604dd4d31a7db.pdf
    • http://kefets.xyz/can_brain_cancer_make_you_angry96x0e.pdf
    • http://foodguideblog.com/scrabble_cheat_sheet_freesx4fa.pdf
    • http://ubzvp.com/allregs_fannie_mae_servicing_guide45lar.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a52dd608-e7dd-4d50-8005-e0fd7a3896b4.filesusr.com/ugd/43d2fc_dfe858a7dcd744529db3a1f0d66f88fa.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7ff0d3c9-6c95-431d-9154-fe5e97a2eb5d/gagibadononokivugubizaxe.pdf
    • https://uploads.strikinglycdn.com/files/da5bf9ff-7951-4787-ba59-04b52b9bdac7/how_much_does_being_a_foster_parent_pay.pdf
    • https://uploads.strikinglycdn.com/files/07b91708-ac36-425e-ac27-247c0614f3e0/56055708096.pdf
    • https://uploads.strikinglycdn.com/files/5dba581e-f2a8-46f6-b7e3-41381e47b5af/74015848132.pdf
    • https://2a082fd4-e93f-4b8e-9e59-408fa046b31c.filesusr.com/ugd/e334dd_035dd93f3d64446f9b0ad39a6653a388.pdf?index=true
    • https://uploads.strikinglycdn.com/files/900be4c8-be99-41f9-a459-b768203cd2e8/shadow_and_bone_trailer.pdf
    • https://uploads.strikinglycdn.com/files/48f137ae-069c-477d-bc8a-e0d51eda2d0e/xasumekalakuw.pdf
    • https://ef9935f7-a918-44a1-999f-f1d50a45e4a7.filesusr.com/ugd/b463f2_8efad99fea744940b68fe9eafc032a77.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b9904cbd-4f8c-46ab-b27c-298cc3f725fe/el_libro_azul_del_padre_gobbi.pdf
    • https://dae57379-2785-4108-a223-4562ecbfc22e.filesusr.com/ugd/87ad98_8c1f4794ba7d4221b0df2a9c46abbe24.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7661f414-f929-41e8-9a1f-2186eed1b580/cub_scout_wolf_book_online.pdf
    • https://7f1158f2-e44e-4cac-991a-806210d1dc3e.filesusr.com/ugd/e4a8e1_6f01165ff30d44f682f35557e5b1a6de.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee85.bin
186f80fbf30d769242c4b4aa3c4abf76596316163400c580cc11ccd6cc6f23d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE85 5560 bytes
font_01_sfnt_off0001017a.bin
0367289a84d42d6873bd67ef2cff0121d835204752d636265c3072de3b75cc1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1017A 11244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.