Malicious PDF — malware analysis report

Static analysis result for SHA-256 376975a14566bdc2…

MALICIOUS

PDF

92.8 KB Created: 2021-02-06 13:16:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: ce3f036c922d2f2754176ae92bd305e2 SHA-1: e447baf9fa0f403ee2ca9d790221f97685e6c5ea SHA-256: 376975a14566bdc207ca77102ff5cc2805fd2fde4698a51ee78ddd77a35f2419
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, which is a common tactic for phishing or distributing further malware. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and extensive external links suggest it's designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/123?utm_term=azur+lane+dorm+supplies+mission PDF link annotation
    • https://posilopawirina.weebly.com/uploads/1/3/4/3/134353572/251275.pdfIn PDF document text
    • https://cdn.sqhk.co/lunapolakezo/ajaKJgI/voice_recorder_on_iphone_7.pdfIn PDF document text
    • https://cdn.sqhk.co/loxowopiv/32tiazF/lemon_bundt_cake_recipes_from_scratch.pdfIn PDF document text
    • https://cdn.sqhk.co/xaloridinef/jgezUwz/dog_simulator_online_free.pdfIn PDF document text
    • https://cdn.sqhk.co/nomitusibop/ehbjXlM/29_april_asteroid_time_in_nepal.pdfIn PDF document text
    • https://cdn.sqhk.co/jekefebiba/e4geVD1/cartelera_cinemark_ecuador_guayaquil.pdfIn PDF document text
    • https://namoturobiro.weebly.com/uploads/1/3/0/7/130739164/wewawibijelapebik.pdfIn PDF document text
    • https://jesebumu.weebly.com/uploads/1/3/4/6/134617302/pegewutuxarona-dogofare-lefafal.pdfIn PDF document text
    • https://cdn.sqhk.co/vimanagadu/zhhjghh/ruvoxafog.pdfIn PDF document text
    • https://cdn.sqhk.co/benibavagoge/dmjhhgA/54172543694.pdfIn PDF document text
    • https://dotomogef.weebly.com/uploads/1/3/4/7/134760479/fawelumivegevavuwad.pdfIn PDF document text
    • https://cdn.sqhk.co/javomekoru/x1ZihAJ/business_management_major_in_operation_jobs.pdfIn PDF document text
    • https://cdn.sqhk.co/ganuniwiku/higij1R/nevenulefebiwijogogawa.pdfIn PDF document text
    • https://cdn.sqhk.co/zipirevofu/hSihgeq/news_today_fox_8.pdfIn PDF document text
    • https://ligonulijer.weebly.com/uploads/1/3/5/3/135318365/ximumujagate.pdfIn PDF document text
    • https://sekilulijafos.weebly.com/uploads/1/3/1/4/131438177/784dc7f.pdfIn PDF document text
    • https://cdn.sqhk.co/medujebukoma/aEnhihf/wwe_news_smackdown_live_results.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011203.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11203 8200 bytes
SHA-256: 83dcc7d344246a9bc23d74e2a4e093c0bde7dd319b67ac0791419e71272a1dea
font_01_sfnt_off00012d40.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D40 5144 bytes
SHA-256: cab1debddb562949582d94d24c5958aad45dc8dcfa022b9cdf2f1cadcd512d3f
font_02_sfnt_off00013eac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13EAC 11380 bytes
SHA-256: 712ebafc4226837af3ef8678034ae929489ba7109709fcd0ac7b24d8c8f38a96

Open this report in the interactive analyzer, or submit your own file for analysis.