Malicious PDF — malware analysis report

Static analysis result for SHA-256 3365e27486f00b6b…

MALICIOUS

PDF

80.3 KB Created: 2021-02-17 11:53:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 2066f7c2c6a59e35f65a0c8d2a7dffc1 SHA-1: e98157f5bca76aa9d4bb1c6847d4c676c71b0978 SHA-256: 3365e27486f00b6bc56bb2ffad68eabea176d46aba79a6b7e821fd714139b6d1
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of external links, many pointing to PDF files on Weebly and other hosting services, suggesting a link farm or SEO poisoning tactic. The 'SE_CLICKFIX' heuristic indicates the document attempts social engineering by instructing the user to execute commands, likely to bypass macro restrictions. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to download and execute a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/123?utm_term=windows+shortcut+keys+monitor PDF link annotation
    • https://kojemugolipoxo.weebly.com/uploads/1/3/4/7/134729864/wixos.pdfIn PDF document text
    • https://jobalexaxikut.weebly.com/uploads/1/3/4/8/134892204/silamonerepevo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490738/normal_6006138f00dcd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374847/normal_5fd62a03cb000.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489838/normal_5fdece7de2111.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449172/normal_5fc770745ff4d.pdfIn PDF document text
    • https://vupimolafi.weebly.com/uploads/1/3/1/3/131398504/nilanupuji.pdfIn PDF document text
    • https://fuwewarudizikip.weebly.com/uploads/1/3/4/6/134644733/d9814b54.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412588/normal_5fdf08ddc6427.pdfIn PDF document text
    • https://sinuvuliwazima.weebly.com/uploads/1/3/1/8/131871572/sekubivinim-kudabo-remodariwokavaz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420604/normal_60106302c99ed.pdfIn PDF document text
    • https://zidadosivifaju.weebly.com/uploads/1/3/0/7/130775619/5bca8.pdfIn PDF document text
    • https://ledajesaler.weebly.com/uploads/1/3/4/0/134041179/2871449.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4500887/normal_5fcec0c32d77a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485166/normal_60128b065d78a.pdfIn PDF document text
    • https://givepatodanino.weebly.com/uploads/1/3/6/0/136097232/sazimekejozatomum.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389823/normal_5fdd8283241b4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488130/normal_5ff2740db2318.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4462992/normal_5fec83433cd6b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zamoguwudegovo.rf.gd/69830488638.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8D0 5208 bytes
SHA-256: 61cd4932fac124122aaadec75657862c055b410384f4e271eaf0eb8dbdf078da
font_01_sfnt_off0000fa79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA79 10408 bytes
SHA-256: fe48fb175a02d5e839bc547662e3cf33f9166f8527638dbf9660ce9dcc59c68c
font_02_sfnt_off00011e46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E46 16116 bytes
SHA-256: b0fa52173cf04b285f5a6379e59dbec661bcf0e06b6cb6d2876f3e95daaaabac

Open this report in the interactive analyzer, or submit your own file for analysis.