Malicious PDF — malware analysis report

Static analysis result for SHA-256 38178f498b4c6b99…

MALICIOUS

PDF

77.0 KB Created: 2021-03-30 12:19:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b4a90cc862cfe3438fc9dafa65da8d71 SHA-1: 6e697160c8e1a4eb0ca984605f5e133ea2548a3d SHA-256: 38178f498b4c6b9906749cf99d9c26232949527c1a3f272e6f259ee22901084d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ML classification and ClamAV, as malicious and likely phishing-related. It contains a large number of external links, suggesting a link farm or redirection scheme. The document body, though heavily obfuscated, appears to be related to 'finding duplicates in google spreadsheets', which is likely a lure to direct users to malicious or spam websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=find+duplicates+in+google+spreadsheets
    • http://wide-take.top/86680094537zl50b.pdf
    • https://cdn-cms.f-static.net/uploads/4378856/normal_604fe3411c0db.pdf
    • http://slmit.space/determinants_and_cramer_s_rule_worksheetsf26ww.pdf
    • http://mobufuwiwid.medianewsonline.com/xozogiga.pdf
    • http://musc-media.xyz/vex_on_tangled_shore3nygz.pdf
    • http://zesaguzijor.mypressonline.com/betaina_de_coco.pdf
    • http://artdebug.site/alla_prima_oil_painting_techniquesdcfvo.pdf
    • https://cdn-cms.f-static.net/uploads/4481990/normal_602963cf5087d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0dd4521b-3e41-4083-9bcc-807cce03ae78.filesusr.com/ugd/cfe2e9_11ecd8f767834c5399d16e3df9023b29.pdf?index=true
    • http://vaxusumimez.rf.gd/answer_that_and_stay_fashionable_meaning.pdf
    • https://5f8b0e40-2141-4341-98ab-6145db4b8156.filesusr.com/ugd/2072cd_dc801b3aecf34326882982c5e294c3fc.pdf?index=true
    • https://ca483b97-61ac-4196-bca0-6b249c18eca9.filesusr.com/ugd/b27199_b3722da32dcc4dc099ec8c3a3d661da8.pdf?index=true
    • https://66f9544f-8325-470d-a543-c07714603334.filesusr.com/ugd/4b2642_23125395350245eb849945723a03a11c.pdf?index=true
    • https://e791dc30-71fd-4519-a75e-453748eb9c32.filesusr.com/ugd/8a5fcf_414f2f076a1140f0a4a574b51b54ecd6.pdf?index=true
    • https://48936d5e-4b15-4059-a328-ddb12afcc15e.filesusr.com/ugd/173145_65b5947787cc455fb0c8ad3ea89d9d4f.pdf?index=true
    • https://7ef7ebf0-bcb0-4ca2-8538-5a19c3e9f01c.filesusr.com/ugd/aff7ca_1fb71dbc0b204644bdbfe3d01eaf08c5.pdf?index=true
    • https://2e81f42f-67f9-46a9-89e2-a5f3ab3b03ee.filesusr.com/ugd/f138f5_3ce3cde1dcde45818fe2b523f5266ddd.pdf?index=true
    • https://a40b6db0-1679-4e03-879f-ac5827b9aa7d.filesusr.com/ugd/dba42a_d34e4ce4a3ec4a2c9a723285a5a6268a.pdf?index=true
    • https://e1cf253b-b3af-4135-a675-1c3c021177f9.filesusr.com/ugd/111c46_421df40292a84ef1ae427f05491ef97f.pdf?index=true
    • http://kapodos.rf.gd/goodman_masson_timesheet_login.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edac.bin
f65e96f5e27fe36be8e03a266a6c85f6b89997bb72bfaa74b52a4251609519b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDAC 5288 bytes
font_01_sfnt_off0000ff9e.bin
cf2a6dc62e4f227ef212c8b3234e0cf068cc7b103e3ff135792736b6ceeca1ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF9E 11452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.