Malicious PDF — malware analysis report

Static analysis result for SHA-256 36a52c5796ca765a…

MALICIOUS

PDF

73.6 KB Created: 2021-04-05 10:13:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 184b37bc32299a203931b88a4c9f65f8 SHA-1: 0e41aaa4960aa3d65aab5801207efc15d8805ec8 SHA-256: 36a52c5796ca765a5bd0d75b7357d433777109e2bfb56324cd79535296ea3253
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to a product manual, which is a common tactic for phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=panasonic+inverter+microwave+manual+nn-sf574s PDF link annotation
    • https://cdn.sqhk.co/vowibesep/6EohhfB/60425984123.pdfIn PDF document text
    • https://ligotilup.weebly.com/uploads/1/3/4/3/134313371/9717757.pdfIn PDF document text
    • https://nulowuze.weebly.com/uploads/1/3/4/6/134614321/9392947.pdfIn PDF document text
    • https://mitojebani.weebly.com/uploads/1/3/2/7/132711961/ce2f9f086bd02.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481667/normal_6013ce189e93a.pdfIn PDF document text
    • https://cdn.sqhk.co/nubotixuf/jjiigiP/46977237823.pdfIn PDF document text
    • https://cdn.sqhk.co/jimavidozeze/jghggct/movie_primeval_trailer.pdfIn PDF document text
    • https://konovupifa.weebly.com/uploads/1/3/0/7/130775136/4315646.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450724/normal_6054fa03ad2c7.pdfIn PDF document text
    • https://cdn.sqhk.co/leluforeref/chijjgg/ancient_china_war_strategy.pdfIn PDF document text
    • https://cdn.sqhk.co/bidekidarub/uijhifZ/92922921183.pdfIn PDF document text
    • https://beretukajawedu.weebly.com/uploads/1/3/4/7/134713042/1405674.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/baxegezivumi/naduxesakaguxarifivolaj.pdfIn PDF document text
    • https://s3.amazonaws.com/fulosobezur/kabolotumatewofuwaz.pdfIn PDF document text
    • https://s3.amazonaws.com/tedowafomaru/xidobigafukudo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f66dd275-c786-48c2-b3df-83ee0b40c62a/hp_laserjet_100_color_mfp_m175nw_black_toner.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f08cf35-5205-4ffe-aa4f-9afc34ad62c2/ryobi_leaf_blower_40v_review.pdfIn PDF document text
    • https://s3.amazonaws.com/nilafafakem/kokejanavodalamimez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c7fa540-5a28-4bff-9083-341955fb29b2/1415745434.pdfIn PDF document text
    • https://s3.amazonaws.com/boduxatavepe/the_secret_garden_movie_2020_on_netflix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40de9781-88f1-4891-abb3-78a2b15a042f/18758534003.pdfIn PDF document text
    • https://s3.amazonaws.com/fosalizuzu/vamobapuxawegenu.pdfIn PDF document text
    • https://s3.amazonaws.com/xalexojaxipud/blacklight_retribution_chip.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000def9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEF9 5504 bytes
SHA-256: 1a06ef2a436fda89c1755c61422a291a99143e3149e9957bebfb582890a0552c
font_01_sfnt_off0000f1cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1CC 10904 bytes
SHA-256: 82cff2d4e075e81d162843e3418b15f301e1c234b780f186fbe3cc787c91c7bd

Open this report in the interactive analyzer, or submit your own file for analysis.