Malicious PDF — malware analysis report

Static analysis result for SHA-256 38828c992a657fbb…

MALICIOUS

PDF

84.1 KB Created: 2021-03-27 21:59:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2275d866f625e819ba0d105ff25183f8 SHA-1: aaa2c60b557129538cef701f36a03ae136620df2 SHA-256: 38828c992a657fbbd40b4c983d5f0899c1e2b0cbfff223567f5a35212f9f8557
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, suggesting a link farm or phishing attempt. The presence of embedded URLs and the overall structure indicate it's likely a phishing document designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=blush+face+emoji+android
    • http://lonemap.medianewsonline.com/34952151958.pdf
    • http://pemufosapakem.mypressonline.com/bee_production.pdf
    • http://kadaxejob.mypressonline.com/how_to_write_a_fairy_tale_short_story.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/947facb6-b0f3-4858-bfe3-2f01cb73cb29/verojezigugevuzadarimofeg.pdf
    • https://37bcb4aa-7747-4ff6-a352-0e22bf983c21.filesusr.com/ugd/4393d3_a46c48573a0e4667932e815f6fe197da.pdf?index=true
    • https://s3.amazonaws.com/sefepugolupalax/rideraminoxan.pdf
    • https://s3.amazonaws.com/tupofelasujewas/horario_del_tren_de_long_island.pdf
    • https://uploads.strikinglycdn.com/files/60a31b77-8c0a-4b15-b44e-2724884c5fdd/25422399628.pdf
    • https://c751e6e8-0850-424d-b14e-d7ae46260796.filesusr.com/ugd/bc1028_4ecaaebd4b174b11beb06abf9140ae6c.pdf?index=true
    • https://7aff118d-26f6-4d76-9bc9-1838009e7274.filesusr.com/ugd/f80014_c2439f99e1ad4f43b31e6bbaac522ce1.pdf?index=true
    • https://s3.amazonaws.com/nedijowewoded/17160052830.pdf
    • https://s3.amazonaws.com/xilasisefi/92522984869.pdf
    • http://sawesupunozigiv.atwebpages.com/36600668478.pdf
    • https://s3.amazonaws.com/dabatisew/android_based_attendance_management_system_abstract.pdf
    • https://s3.amazonaws.com/viwoxuz/7953196426.pdf
    • https://s3.amazonaws.com/batoragubukepo/88197599089.pdf
    • https://bef89f6e-6323-4b84-ad9d-a44490bfcc4f.filesusr.com/ugd/96768c_78d042dce84d4425b5d59a95bf0756d1.pdf?index=true
    • https://s3.amazonaws.com/resixexi/gevoligesaveziwaz.pdf
    • https://uploads.strikinglycdn.com/files/806e5c2b-1683-40e8-b1c4-3fdd34dde156/irobot_roomba_i4_4150_vs_i3.pdf
    • https://s3.amazonaws.com/tobojelusiwi/40622840579.pdf
    • https://b1c30c75-ab46-439a-884d-3836ae4b8a49.filesusr.com/ugd/2d1648_e45211876dc94c5a9ea9d9992eef6399.pdf?index=true
    • https://s3.amazonaws.com/fekazudabo/identidades_trigonometricas_reciprocas_y_pitagoricas.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4dd.bin
c1a1dc64673d30859217a6f316fb12a293bd73ef1032dcba4f807416b1c3f8e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4DD 3656 bytes
font_01_sfnt_off000101f0.bin
5eae3595893048274e5e9a381c53d981ef31c29609ee96baa28bbdbef544ad53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101F0 5388 bytes
font_02_sfnt_off00011411.bin
29e65d27965e87bff98d49ac9da992c3660fe0b15a5e8502ddedb984937c1d31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11411 2144 bytes
font_03_sfnt_off00011dd0.bin
91477c93977b2e49156d9621ecf887dc5061e709cbb75be5589bd7ab7b5c2b46		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DD0 10588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.