Malicious PDF — malware analysis report

Static analysis result for SHA-256 303773d31de3d323…

MALICIOUS

PDF

69.3 KB Created: 2021-03-29 00:31:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a72c17ec4787053f34d448dedb8520b SHA-1: 29fc05474ffbaaa3c7ac5db947acf4bb7460ee70 SHA-256: 303773d31de3d323ff7991adb145d8939849c989483844c7aecf983bb760b8f4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains numerous external links, many of which are associated with SEO link farms and potentially phishing. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=type+2+diabetes+for+dummies+pdf
    • https://cdn.sqhk.co/lojavowi/2yhgqgD/777_casino_schweiz.pdf
    • http://fikunigogijori.22web.org/android_camera_record_video_tutorial.pdf
    • https://cdn.sqhk.co/nevupediwix/Lgfje80/36817507433.pdf
    • http://juronesewuku.22web.org/5123379050.pdf
    • https://cdn.sqhk.co/vibebexez/B8XvPgg/that_s_you_ps4_online_multiplayer.pdf
    • https://cdn.sqhk.co/vibisimak/iahbjaW/spotify_music_mac_free.pdf
    • http://razagewodun.iblogger.org/65877376928.pdf
    • https://cdn.sqhk.co/wasuxuletiz/YZb8gig/kowabuzutubefobomazugamas.pdf
    • https://cdn.sqhk.co/zufutetuwume/gieghCF/kafik.pdf
    • https://cdn.sqhk.co/ninazixador/kjdiijd/8000769568.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gotitibekovi/clue_junior_game_sheets.pdf
    • https://s3.amazonaws.com/tinezedu/78302813584.pdf
    • https://f405dec1-7f90-4f4c-a861-5286f67d0127.filesusr.com/ugd/ab922d_792b7945fe9b48d0866626ad098b2eed.pdf?index=true
    • http://zutezirupatot.rf.gd/muvivegobamoxet.pdf
    • https://d064ede3-316f-4d13-8ec5-014b2136b3bd.filesusr.com/ugd/154db6_ead531b6ada34675ab23c080595ec79f.pdf?index=true
    • https://s3.amazonaws.com/wujodibu/jaybird_freedom_sprint_review.pdf
    • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_34c3af109ebc4989bf2ae7391b5e4708.pdf?index=true
    • https://8d59741e-369e-44be-b01e-8fbcb09d2d01.filesusr.com/ugd/7cefa9_113e43b4b3ca4d8b9c5d242624cdf916.pdf?index=true
    • http://felixoxajaxev.epizy.com/risk_management_strategies_in_social_work.pdf
    • https://s3.amazonaws.com/davolazupivowi/united_states_army_dress_uniforms.pdf
    • https://7095e710-59ac-4d27-8a5a-f3bbcaf65deb.filesusr.com/ugd/418e76_d4dcef59fbe140b7965dd3b1edf5317d.pdf?index=true
    • https://s3.amazonaws.com/fogibi/renuxolanutopepepodoti.pdf
    • https://s3.amazonaws.com/xugigabitulu/giboveputezafafigafef.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1ba.bin
8541f0c9637185919cd3ba92e22ee8b7fb0b4f100fd77500bab052e6f10882b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD1BA 5480 bytes
font_01_sfnt_off0000e44c.bin
600a4e9526c36e8926e2b2b43f7bb82f5bd34ef41182d86049425a210a9f3848		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE44C 9876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.