Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c48009188db4c00…

MALICIOUS

PDF

98.6 KB Created: 2021-02-07 18:11:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 2c5fa8ebfb7b2ee1f7b1aa734c15c8e2 SHA-1: 3f696286c8b44400c2e8f096797be9fc069ca095 SHA-256: 2c48009188db4c0029650fed1bb67d45b86e609f3f80ff3eb8f946cf101248fb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics as malicious, including ClamAV and an ML classifier. It contains a large number of external links, indicating it functions as a link farm. The embedded URLs suggest an attempt to redirect users to potentially malicious content or phishing sites. No scripts were extracted, but the PDF structure and numerous external links point towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wb?keyword=esc%20guidelines%20management%20valvular%20heart%20disease PDF link annotation
    • https://cdn.sqhk.co/ridefapagol/cwstSoK/dawn_of_steel_mod_apk_happymod.pdfIn PDF document text
    • https://rumikupim.weebly.com/uploads/1/3/5/3/135310872/ad51eb842.pdfIn PDF document text
    • https://dukopovofozevi.weebly.com/uploads/1/3/5/2/135295758/369924.pdfIn PDF document text
    • https://cdn.sqhk.co/zolewiko/5EihicD/bazovirabevukalikux.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470968/normal_5ff89b9b3d736.pdfIn PDF document text
    • https://kikizesojumare.weebly.com/uploads/1/3/4/7/134718780/d56c8d2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4478146/normal_5fcae7dcc1d64.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455377/normal_6000395e33769.pdfIn PDF document text
    • https://cdn.sqhk.co/xejudawadoni/Jggdicc/lokicraft_2_multiplayer.pdfIn PDF document text
    • https://cdn.sqhk.co/levowexesu/hjuiaQk/78870222068.pdfIn PDF document text
    • https://cdn.sqhk.co/fegadosijete/OiiEhhb/sms_marketing_services_in_pakistan.pdfIn PDF document text
    • https://cdn.sqhk.co/belesobikezi/javW68D/zebapamix.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460231/normal_601ddd2816f18.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471958/normal_6017cf2f872fa.pdfIn PDF document text
    • https://cdn.sqhk.co/xovikojux/ij6ibiN/jiwokase.pdfIn PDF document text
    • https://cdn.sqhk.co/lelabepena/Qge5gdy/redivawesebif.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387704/normal_5fe8f0f66dfb7.pdfIn PDF document text
    • https://rixagebama.weebly.com/uploads/1/3/0/7/130738507/lezovimoboruk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464078/normal_601f793748d68.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476273/normal_600b4c0cdaf9f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417309/normal_5fc67376551f0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001419f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1419F 5372 bytes
SHA-256: e6c420e03b08866b7f007caa03c119b03ab0f11b6f1d0f1eb2e5cd0aa13d9d75
font_01_sfnt_off000153c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x153C0 11956 bytes
SHA-256: 6b7fbafb9af42808f18d37000dd3e51b119cb1b31bd62370139d48242796d821

Open this report in the interactive analyzer, or submit your own file for analysis.