Malicious PDF — malware analysis report

Static analysis result for SHA-256 35703fa2a771a2d0…

MALICIOUS

PDF

76.6 KB Created: 2021-03-14 13:13:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5ac4d58985b5dcb89e10946d0e123990 SHA-1: d4924f1948f7042ee16c6860d79a3cd27b2d8119 SHA-256: 35703fa2a771a2d053c5824edf508a52d556ff99901efaf233e74fecb8dc2a70
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was identified as malicious by multiple heuristics and a machine learning classifier. It contains numerous external links, including one that appears to be a lure for a quiz to win an iPhone. The presence of embedded links and the overall structure suggest it's designed to direct users to potentially malicious websites for phishing or scam purposes. No scripts were extracted, but the PDF structure itself is indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=win+a+iphone+6+quiz
    • https://cdn.sqhk.co/fodexuxefeba/iHgdidb/mpl_premier_league_app_download.pdf
    • https://cdn.sqhk.co/giwibilawa/egdhdgj/phage_display_antibody_generation.pdf
    • https://cdn-cms.f-static.net/uploads/4387821/normal_60292aeae303b.pdf
    • https://static.s123-cdn-static.com/uploads/4457843/normal_5ff4faff45352.pdf
    • https://cdn.sqhk.co/wetewajaba/hdpgc7E/flying_flappy_bird_download_mac.pdf
    • https://cdn.sqhk.co/jirudumom/fgchagc/nenelewematew.pdf
    • https://cdn.sqhk.co/lekuruzomef/hBhhxjd/feguzukejodojopete.pdf
    • https://cdn.sqhk.co/kekelivig/aicwibo/xofakavoxe.pdf
    • https://cdn.sqhk.co/zalopubid/dxgfAAp/8870760815.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vukujidor/xetufopa.pdf
    • https://s3.amazonaws.com/bipepezuwed/sebofuroxitutafi.pdf
    • https://a1d44d2f-bad4-4ab4-86db-8e02739301d9.filesusr.com/ugd/97634b_917888bd15574fc18bfe311bc282fec3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3d738864-4d88-4828-95db-f8bcb3db72ee/samilesokekadizuxiko.pdf
    • https://s3.amazonaws.com/laginekux/70926514791.pdf
    • https://e40da922-b0e4-44be-9878-2d4898ccab21.filesusr.com/ugd/3a38e0_9a5adc58f1fc40f8a481fa97e8a26ff8.pdf?index=true
    • https://s3.amazonaws.com/nagudo/33617414878.pdf
    • https://uploads.strikinglycdn.com/files/6ce9168a-d647-42ea-8e33-c7caaa2ce90b/90799984161.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed4a.bin
4211781e48991c7d618de946e35d8cd526ee6fb887647d1531b859d55299c5ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED4A 4944 bytes
font_01_sfnt_off0000fe3a.bin
2fa4830596d21b61c2766370a5d373eff3e8aa9e2c5b9c8bafb3331f14102835		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE3A 11448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.