Malicious PDF — malware analysis report

Static analysis result for SHA-256 35ddada037ab24cd…

MALICIOUS

PDF

141.9 KB Created: 2021-04-09 18:44:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5783336193e7aba789d838479b42250e SHA-1: db0152a7764d7625762f425b3bb3c2e766800bdb SHA-256: 35ddada037ab24cddeb71f88a346d0178c24e62d950d16fee7b9b7d5bcf08bc4
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a high number of external links, many pointing to suspicious domains, indicating a link farm or phishing attempt. The 'PDF_SEO_LINK_FARM' and 'PDF_SUSPICIOUS_LINK_LURE' heuristics strongly suggest malicious intent. While no scripts were directly extracted, the nature of the embedded links and the ClamAV detection point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=cuanto+rinde+un+metro+cubico+de+arena
    • https://cdn.sqhk.co/korulifesewa/IxcYehe/wenapi.pdf
    • https://cdn.sqhk.co/wuxobilan/Sjbhaua/supaxadoxowum.pdf
    • https://cdn.sqhk.co/kekelivig/haJIN7X/xogapebubibimaj.pdf
    • https://cdn.sqhk.co/pesuxitum/jcyaiiN/tugofatux.pdf
    • https://cdn.sqhk.co/jusitufugaf/ihhcaY4/96465300810.pdf
    • http://verifybadgesbusiness.com/logistica_internacional_libro_pierre_david_gratis22sl6.pdf
    • http://bodyita.space/is_it_hard_to_get_bls_certifiedgq8ay.pdf
    • https://cdn.sqhk.co/gunonutib/isjchjb/39557537829.pdf
    • http://7lessons.fun/7133319083772rmw.pdf
    • http://com-login8.xyz/cute_cat_live_wallpaper_downloadvctje.pdf
    • https://cdn.sqhk.co/towafeniruje/eaMiegi/suwamijamamoxanuzenu.pdf
    • https://cdn.sqhk.co/lokojagivel/8pjjjgV/ravensburger_puzzle_3d_disney_castle.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/domegagowevag/cdr_format_pliku.pdf
    • https://11ab4cf5-156d-4417-99e9-5039b2a7eb5f.filesusr.com/ugd/82d61e_972e6175c9634aa48f37acb4cb6b136f.pdf?index=true
    • https://s3.amazonaws.com/bejexe/23767244336.pdf
    • https://2ddedb0e-b7b0-41c9-a8bc-c018bd0e6e4c.filesusr.com/ugd/70094d_da109ab8f18048bfbdaea451b9a2d95f.pdf?index=true
    • https://23da7c74-6e14-424a-b22a-901aa35eafb1.filesusr.com/ugd/9cc572_3ac30ac1972d4120b8f98b21dbbc00e7.pdf?index=true
    • https://65de77fc-0341-4fd2-89b2-cd6b005a91de.filesusr.com/ugd/cf79db_23bdaf6a4f094bfa870f9e608a814f9c.pdf?index=true
    • https://770cee9b-59ea-4c2b-ae8d-aad83b0abb79.filesusr.com/ugd/8b25c7_950323b2b0284d9990f319f1a4a3fb9b.pdf?index=true
    • https://1ce8651a-bfbb-4b9a-b1bf-24b3b574775a.filesusr.com/ugd/ac72e0_6d61baa4774745968b804975070b84b8.pdf?index=true
    • https://s3.amazonaws.com/tonemakopinibem/how_to_write_a_senior_farewell_speech.pdf
    • https://s3.amazonaws.com/jesidofefe/57133897503.pdf
    • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_d51876e236b04095bf6448e29224977e.pdf?index=true
    • https://a581e706-3bf6-41fb-8978-ad4d4077590d.filesusr.com/ugd/afbe6b_91879050cf89467c816bbb06cda2c661.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d51a.bin
87b96fde095525ec277692a966aab5354c6a0aaa3507d81e0f8f42420d01112c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D51A 4920 bytes
font_01_sfnt_off0001e5b8.bin
603cf7679272c4305bd17322e612b4d7308719503218a45b5be74341527074af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E5B8 12264 bytes
font_02_sfnt_off00020d60.bin
04fc1d06bb06caf4bb45d281d8a8975ce78841b328a86528142efc2a8043c1ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20D60 17552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.