Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c84a7eafaa8be15…

MALICIOUS

PDF

75.2 KB Created: 2021-05-02 04:34:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 85922cb1d2b8275c8ec4d14f954b953f SHA-1: 849cf4bb0371351e57a7d9a52c56c0ca63e79379 SHA-256: 3c84a7eafaa8be1577ade5af41b521a6f0e9d576c3ed6957b5a119f7b360cb9f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=cabela%2527s+dehydrator+jerky+temp PDF link annotation
    • https://cdn.sqhk.co/xezafube/ehaijBH/16101170017.pdfIn PDF document text
    • http://chambreapp.xyz/biblia_hebraica_stuttgartensia_en_espaols40jc.pdfIn PDF document text
    • http://geekcods.com/wipumadhyeoc.pdfIn PDF document text
    • http://realnoe-obshenie.online/ramusumobobibigagqe30t.pdfIn PDF document text
    • https://cdn.sqhk.co/sonorizeluwi/iagTCgh/79385622342.pdfIn PDF document text
    • http://twitter-center.com/electromagnetic_spectrum_coloring_worksheet_answer_keys939a.pdfIn PDF document text
    • http://linza.media/14058003884zl0zt.pdfIn PDF document text
    • http://dalkomis.website/twilight_saga_eclipse_2010_full_movie_in_hindi_downloadye81e.pdfIn PDF document text
    • https://cdn.sqhk.co/bowawugafux/aGRiel1/nascar_track_speed_limit.pdfIn PDF document text
    • https://cdn.sqhk.co/zirimikuj/wijUYii/49548528809.pdfIn PDF document text
    • https://cdn.sqhk.co/kufomopinu/byjgVhg/uber_driver_salary_new_jersey.pdfIn PDF document text
    • http://5dradio.ru/sibaxazenezonaxaxopigumuti87u7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nelizenejakarug/46302852594.pdfIn PDF document text
    • https://s3.amazonaws.com/geraromu/john_deere_190c_transmission_fluid.pdfIn PDF document text
    • https://s3.amazonaws.com/degagaziv/42775557104.pdfIn PDF document text
    • https://s3.amazonaws.com/sonutopexaramuf/poultry_nutrition_books_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/vitelitubovuluj/12168968861.pdfIn PDF document text
    • https://a21f0d7d-5fe0-4a99-a381-3b18266e0880.filesusr.com/ugd/6c313a_9849eeff539d4e7c9e7136bc6654da19.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lebejos/bopakunuginizudokafazide.pdfIn PDF document text
    • https://6f8cb219-4830-455d-9ced-b55e65700e85.filesusr.com/ugd/fd30ac_960226373e3c449ea19c35e3b642d1ad.pdf?index=trueIn PDF document text
    • https://c84ffda1-e72a-45fa-8ce8-a771970cf326.filesusr.com/ugd/9fd656_09f7d5e9b70e4e5e8383969b0c4c3f38.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rewepalazamiso/felut.pdfIn PDF document text
    • https://a1d3e036-d9a1-4be1-9d2f-eedbb581cb22.filesusr.com/ugd/3ce946_d095bf0427354a818916a55eeda1b2fa.pdf?index=trueIn PDF document text
    • https://5926284e-b61c-4ed0-95e5-27b9feedd2c3.filesusr.com/ugd/50c35f_2679b904f9e14dc1a34ad05113e932de.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6C2 5520 bytes
SHA-256: 8281a4652ad420d4a660ae6150c8fcbd2db5963f27756a92fc90e70acb7367fe
font_01_sfnt_off0000f95a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF95A 11324 bytes
SHA-256: 8bf9748224f154db4bb3f686a2bdb0800d3483d07507490fee1dae517aded1a3

Open this report in the interactive analyzer, or submit your own file for analysis.