Malicious PDF — malware analysis report

Static analysis result for SHA-256 3018971969b52241…

MALICIOUS

PDF

87.1 KB Created: 2021-05-09 06:50:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 81f2f02f641ada96f6b01a5593cb2fad SHA-1: 9114e8f8b102177710f83229d75e70c56c6d6327 SHA-256: 3018971969b5224107da8a83fcc44a209317be7cbe9c73d45267ae8fc6eae4d2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a link farm and a primary malicious URL, suggesting a phishing or scam attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing lure designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=what+country+has+pretty+little+liars+on+netflix+2021 PDF link annotation
    • http://figejewumoposes.getenjoyment.net/tutorial_point_python_free.pdfIn PDF document text
    • https://cdn.sqhk.co/gukitane/hDgcjjJ/the_impossible_quiz_2_mobile.pdfIn PDF document text
    • https://cdn.sqhk.co/sepokafaru/bicRfjb/53454841051.pdfIn PDF document text
    • https://cdn.sqhk.co/pomorezolo/eggAMOf/24586514609.pdfIn PDF document text
    • https://cdn.sqhk.co/jivomawufem/hgLifbl/33582182657.pdfIn PDF document text
    • http://vonoxafaku.scienceontheweb.net/achilles_tendinopathy.pdfIn PDF document text
    • https://cdn.sqhk.co/zizenozi/UXvgehf/clumsy_ninja_mod_2020.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://4f0f5a39-0a2f-4cdf-b4e4-40a644fad8b9.filesusr.com/ugd/2024fe_84b91694be6a4f7f832c5a2549363068.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jawusawar/que_son_los_lipidos_y_como_se_clasifican.pdfIn PDF document text
    • https://5b3500e9-40b4-440a-9ada-171ed8bcf4c9.filesusr.com/ugd/7820d0_f97fa1e2e76b4ea1bb33108fe33659ad.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bizamesuwepe/adverbs_exercises_with_answers_for_grade_6.pdfIn PDF document text
    • https://s3.amazonaws.com/resixexi/blender_low_poly_tutorial.pdfIn PDF document text
    • https://s3.amazonaws.com/tokafanawa/fifty_shades_of_grey_trilogy_music_playlist.pdfIn PDF document text
    • https://s3.amazonaws.com/gagotaniwipure/72033197023.pdfIn PDF document text
    • https://s3.amazonaws.com/wofaxil/majupenatowugegorozo.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibudasagas/sheetrock_sander_home_depot.pdfIn PDF document text
    • http://gozidonozali.myartsonline.com/nidote.pdfIn PDF document text
    • https://945b3f91-9c76-4178-be32-f0dab3cfe2c6.filesusr.com/ugd/8d5d69_b5c8821ccd504ff7b2e87909a9fbbba2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zatazewoz/bedfordshire_police_annual_report.pdfIn PDF document text
    • https://s3.amazonaws.com/zaxefemebidaz/pidejunujinekeloluxu.pdfIn PDF document text
    • https://s3.amazonaws.com/senodiw/myers_briggs_personality_test_psychology_questions.pdfIn PDF document text
    • https://s3.amazonaws.com/tinezedu/dietary_guidelines_for_diabetes_in_pregnancy.pdfIn PDF document text
    • https://88bec3ce-9cdd-4818-a95b-bcf8ac49d1e7.filesusr.com/ugd/72df48_92d871dd038a4b8090649611b7719822.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000113a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113A0 5612 bytes
SHA-256: 4c0c6fa1d32a7bca77d43afb84e96fcd3d17083913d17459e42fdadcd302c67f
font_01_sfnt_off000126d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126D5 11292 bytes
SHA-256: 79d7eb7c5326f5d848a72d1807108e1d3cc9bcc3419f44c2f7aa68657420cd12

Open this report in the interactive analyzer, or submit your own file for analysis.