Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a06ea2e88ef4834…

MALICIOUS

PDF

95.2 KB Created: 2021-05-29 07:59:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: b12a8df0e1a11e7827dfb7054a80342b SHA-1: 21e6def5e129c46198ea1cc5b742706d4793624b SHA-256: 3a06ea2e88ef483469e00106792237ec891986247bb7143cdef892c591bd16db
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as Pdf.Phishing.Trojan. The presence of embedded URLs, despite the lack of explicit script content, suggests the document is designed to lead users to potentially harmful external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=marriage+biodata+template+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4365662/normal_603a6102d92c2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4468253/normal_5fe0ba30620df.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4506159/normal_5fdb9a78c03c1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4500911/normal_60038e93ee97f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489428/normal_5ffc7bf332c2a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406229/normal_6062d6d86b130.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501777/normal_605bc08ac8884.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450730/normal_60540c558985a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421061/normal_60018d15b76f8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393209/normal_6010562ed2db4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4458622/normal_6008da584a24b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450038/normal_6067bcfe991d5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392854/normal_5ffffe0b61521.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391624/normal_606549fdc62bc.pdfIn PDF document text
    • https://pobebuzajo.weebly.com/uploads/1/3/4/6/134677480/fasivozuli-vozivanogosade-vitumo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367625/normal_5ff06146f3f67.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413228/normal_5fdd67e6ccddb.pdfIn PDF document text
    • https://zizipidefogin.weebly.com/uploads/1/3/4/8/134852386/7041990.pdfIn PDF document text
    • https://tupunatuluzike.weebly.com/uploads/1/3/1/3/131383671/3156166.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ddcdd033-005d-4352-82e6-c09b7dfb9e98/82542299091.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d07c2e0-b9e9-4040-9237-f0e917b22486/sepudeb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e8a025d-f8f4-4611-9cc2-ceb30d3ede29/4026459147.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1018ed34-af60-4a8c-b339-e7540a350934/mesetusekajididogako.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000137d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x137D8 5328 bytes
SHA-256: ba6cc3809a782c01b991cdd23e15d893e2c741e7bfa8e21e619fe3e548960269
font_01_sfnt_off000149ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x149ED 11004 bytes
SHA-256: 235455216700dc4dba1f30652174543bb545f47c00903bde68c587ccf7dbf555

Open this report in the interactive analyzer, or submit your own file for analysis.