Malicious PDF — malware analysis report

Static analysis result for SHA-256 38cf3846fb2d1af9…

MALICIOUS

PDF

81.7 KB Created: 2021-03-23 18:42:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d229c6f824d7cf9599b7173008b9d176 SHA-1: e30980ec812c01fbb59e24d0ef7559c41ab25aef SHA-256: 38cf3846fb2d1af999bf1b25d7971e96e386dc8cb46146250ed00671dd63273d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a heuristic firing for PDF_SEO_LINK_FARM, indicating a large number of external links, and is flagged by ML and ClamAV as malicious. The embedded URLs suggest a phishing or malicious link distribution scheme, potentially disguised as product-related content. No scripts were extracted, but the PDF structure itself is indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=bissell+pro+pet+carpet+cleaner+parts
    • http://javefuxola.getenjoyment.net/86389742455.pdf
    • http://dasezin.getenjoyment.net/40939029484.pdf
    • http://ruluzuzadol.mypressonline.com/13965795394.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://luxupuxud.myartsonline.com/30111745330.pdf
    • https://d7ae471b-a447-437d-81b4-4e603f8679d9.filesusr.com/ugd/0a3240_05dad7f91c38419fa4e1b45c53848854.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bc0db6b6-86c9-4159-bfea-73871d3e6ed3/how_much_is_a_kfc_double_down.pdf
    • https://uploads.strikinglycdn.com/files/825d8d6d-c796-4686-a9ac-8db8b095cbd8/best_free_flowchart_software_for_windows_10.pdf
    • https://uploads.strikinglycdn.com/files/8b93f307-b44c-470a-b43d-6b21e711418a/replacement_glass_lid_for_rival_crock_pot.pdf
    • https://uploads.strikinglycdn.com/files/5cc4e686-09b3-44e5-8db9-eb2dbea87500/33722272905.pdf
    • https://s3.amazonaws.com/pafiganovavi/carwale_game_song.pdf
    • https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_bd8253c7fcca4b5ea5cd8bd92b269e36.pdf?index=true
    • https://5cbbff6b-7c47-4fbb-abda-9de5069fbc88.filesusr.com/ugd/1a89c8_4d655549da724afe8f6bed9e952b7f14.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4d894310-0846-4881-bf5d-93e3a10c2ef7/52312984018.pdf
    • https://uploads.strikinglycdn.com/files/43a4afae-66c6-4548-b813-a200d9f83c2a/romeo_juliet_songs_download_starmusiq.pdf
    • https://uploads.strikinglycdn.com/files/dfd8a670-cd5f-40ac-9864-6f26d948e822/how_to_do_digital_painting.pdf
    • https://76f5a3e5-08d8-4581-9975-6c1b933a1845.filesusr.com/ugd/dbbd16_51dfbb27eced41359583827707d91d56.pdf?index=true
    • https://s3.amazonaws.com/rejiner/gameboy_advance_emulator_apk_games.pdf
    • https://uploads.strikinglycdn.com/files/73e14102-63a2-4139-a497-93cc3b2137c3/74266419369.pdf
    • https://s3.amazonaws.com/musoxifuvitalo/what_order_to_read_warriors_books_in.pdf
    • https://s3.amazonaws.com/dufekifaral/79513700542.pdf
    • https://30383b9b-b26a-44f4-9a26-03873af8f03c.filesusr.com/ugd/fdee49_7f3690e7416647aba5a2743f9fc419fc.pdf?index=true
    • https://40fd9d30-e691-4ad4-9ff9-7de67b304886.filesusr.com/ugd/45b27a_e34d9159b1d0424bbe25f26375e21a32.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4800b484-7ead-462e-b631-7214ff771ba6/lamizufi.pdf
    • https://uploads.strikinglycdn.com/files/01e3a3ef-1818-464e-baee-8e9bfe10b2cd/69613188735.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010123.bin
7c8fbd2c76ba5cfa6a18e0c9adcd5702e770daecc8fb11b45684116c6a6a8aca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10123 4976 bytes
font_01_sfnt_off00011220.bin
961fdcbade7e45f1b8beb45db479e9397cbccd342a50a59481ec7ab4961f7570		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11220 11320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.