Malicious PDF — malware analysis report

Static analysis result for SHA-256 341e5baf324075b4…

MALICIOUS

PDF

73.0 KB Created: 2021-06-04 06:11:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a035380fca8298f286649308d84b4afa SHA-1: 212efd3655a6f01a9af3bfbc197dca2f0f8209e8 SHA-256: 341e5baf324075b4ef0a1d44e7beea5814baeb11c4ec2b4d743b719747e4b417
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It contains a large number of external links, with the primary URL pointing to a suspicious domain, suggesting a link farm or phishing attempt. The document body, though heavily corrupted, contains references to 'wkhtmltopdf' and 'worksheet', aligning with the link farm heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/pbw?utm_term=homophones+by+bye+buy+worksheet
    • https://verefatodefi.weebly.com/uploads/1/3/4/7/134722939/4176704.pdf
    • https://gaxowaxogofesix.weebly.com/uploads/1/3/4/7/134719425/rasofuvuwoz.pdf
    • https://jifurutirijiguj.weebly.com/uploads/1/3/4/5/134528482/3506703.pdf
    • https://tuzutetenufiro.weebly.com/uploads/1/3/4/7/134716615/tididivogafa-masapi-dafebasijorok-favenuzegediru.pdf
    • https://todusoxi.weebly.com/uploads/1/3/3/9/133999566/4993218.pdf
    • https://cdn-cms.f-static.net/uploads/4452588/normal_602e3287a3caa.pdf
    • https://cdn-cms.f-static.net/uploads/4462354/normal_601dc91c7af19.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pefumugat.pbworks.com/w/file/fetch/144539178/what_happens_if_i_dont_give_my_landlord_30_days_notice.pdf
    • http://sijomirurefi.pbworks.com/f/vikumula.pdf
    • https://uploads.strikinglycdn.com/files/cb6290e0-3328-45f5-bee6-c8d8b0f24a4c/the_mask_of_the_red_death_analysis.pdf
    • http://pukagij.pbworks.com/f/what_is_whatsapp_gold_app.pdf
    • https://uploads.strikinglycdn.com/files/556ad623-958d-42b4-ac89-f5cef9aba550/lagadute.pdf
    • https://uploads.strikinglycdn.com/files/eb03c85c-ecb8-4350-b6ec-38898aa2c134/volume_of_triangular_pyramid_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/3797b01d-21a8-4153-98ff-f8c006ed4b31/jaxazidezoretavawibugofad.pdf
    • http://poxanoralanu.pbworks.com/w/file/fetch/144422268/nufevoj.pdf
    • https://uploads.strikinglycdn.com/files/cb41f6b1-4885-4834-9432-76fce74c8262/ielts_reading_test_2020_with_answers.pdf
    • https://uploads.strikinglycdn.com/files/802e5dac-f62c-4c36-8f4f-b3d0d8260481/somejowolijite.pdf
    • https://uploads.strikinglycdn.com/files/922ae63b-042d-4e78-bc58-f7e9a883df19/attack_on_titan_season_2_episode_6_recap.pdf
    • http://zepadatoju.pbworks.com/w/file/fetch/144416064/how_to_spawn_a_helicopter_in_gta_5_online.pdf
    • http://jozeluwofe.pbworks.com/f/wedaxosibetu.pdf
    • https://uploads.strikinglycdn.com/files/c293d846-f1b1-4265-99d0-8051ebd65c97/96053949252.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e139.bin
93a9da9ee0afe32eec8d9d25490db797a011c0d0c4263929bb7f3bde9bc86252		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE139 5176 bytes
font_01_sfnt_off0000f2b8.bin
aaa300e2679167a50f5227b80e0e55b936d22ebbbf4af97aa7314b690e57139c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2B8 10596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.