Malicious PDF — malware analysis report

Static analysis result for SHA-256 37fabfbb48a1396f…

MALICIOUS

PDF

75.5 KB Created: 2021-04-14 15:18:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 147b7247522e489b7a18f9c99af3679e SHA-1: 7a61d9bff321f3059420ae96542c9de7e1d97d9f SHA-256: 37fabfbb48a1396f102a47e5131bd908a4d6d7acf24a78c94d3bb1afc18c9e29
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, many of which point to potentially malicious or SEO-spam related content. The document body, though heavily obfuscated, contains keywords related to pricing and product names, suggesting a phishing or scam lure. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic indicate an attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=hunter+road+force+balancer+price
    • http://dusamoka.mywebcommunity.org/44805029595.pdf
    • https://cdn.sqhk.co/wimedizi/9gcDgjc/96892734298.pdf
    • https://cdn.sqhk.co/gejupajo/geQhehx/hd_wallpapers_backgrounds.pdf
    • http://nipizakevenuvis.scienceontheweb.net/vimopadanisogalugukime.pdf
    • http://vexetifiridik.mypressonline.com/dulipigudur.pdf
    • http://melidagerukebel.sportsontheweb.net/83842687387.pdf
    • http://pexawegowe.mywebcommunity.org/solving_inequalities_involving_absolute_value.pdf
    • https://cdn.sqhk.co/jozojonujaj/d3Y6Sif/simoku.pdf
    • https://cdn.sqhk.co/libavesonon/0AigVui/bank_of_america_merchant_services_clover.pdf
    • https://cdn.sqhk.co/pikikunifav/iiUWjaP/vamibazuteke.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5c2df1de-05ea-4e17-9aa3-38adc7ce3153.filesusr.com/ugd/ddd609_0221e10ebf824e1c894f94b4d6355273.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ef5b51cb-a1d8-491c-ad07-148475393f11/5e_druid_spell_list.pdf
    • https://uploads.strikinglycdn.com/files/f030b030-e0be-4e86-8e6c-43c9eeccc4c5/valley_rules_billiards.pdf
    • https://aca56392-15ae-48e8-982c-fdf6c4ac0dc3.filesusr.com/ugd/00c070_9d171bb5eca94b9aae077b1b48d31ed9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/08a2f4e9-32fb-4f1d-8d99-59a48256d55b/21894298752.pdf
    • https://uploads.strikinglycdn.com/files/31d99a29-9f92-42d6-9d27-f251bd6e57a0/how_to_read_motorcycle_wiring_schematic.pdf
    • https://uploads.strikinglycdn.com/files/1b44b1f2-4c79-40c4-9bb8-8442853c2965/zajatufapetuwiwebugikinij.pdf
    • https://1bc2da55-d9f9-46f5-9d67-b48dc82c85d4.filesusr.com/ugd/957ce7_aee32cf2c99a4acfa9f5965a1f687722.pdf?index=true
    • https://696f1bd8-06c3-47a7-a8f7-e83e17ec8d18.filesusr.com/ugd/5ad03d_caae7a1e6f0141be9a7ce8e474dda54b.pdf?index=true
    • https://c534e673-b245-4a6d-8787-855fe96db707.filesusr.com/ugd/e19215_cf570f9f97754390bba2aa903cc027ff.pdf?index=true
    • https://80c93ba6-74df-4afb-9852-3a83eaba20e3.filesusr.com/ugd/4cf28d_304df4c37ce6498eacb37cd7b45900d5.pdf?index=true
    • https://ce099f17-eb12-430b-a452-8d789b3ee5a8.filesusr.com/ugd/aef5b7_17a8576dfd7d492babdad72554a3fcc7.pdf?index=true
    • https://ebbb41b5-b8b7-4bfc-9e1b-23e79ad93844.filesusr.com/ugd/5eba67_8bf665f391de49e1994f07d3b57fd781.pdf?index=true
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_0a8216a7cccb4a8596afd228acb516f9.pdf?index=true
    • https://9301df3d-c689-496c-811c-0581e5fecd74.filesusr.com/ugd/f62067_fb0629b1b47746aa82c1d620a7a4a969.pdf?index=true
    • https://a44a9d9e-3ce9-422e-9b5d-83ef2d4925cb.filesusr.com/ugd/3234e9_92e86782a0df426ba67d09044f0917f5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9a9.bin
e49336ea6a39872ab56dbd822b55cf0d7633c88aef80e15fd07969741d832e3f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9A9 5072 bytes
font_01_sfnt_off0000faf6.bin
ad24fd074aea38858c0cbe2d77f0fad4c2b42f70d20a3c263570417fe25861c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAF6 10992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.