Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d1160a23d0cb4ea…

MALICIOUS

PDF

80.5 KB Created: 2021-05-31 10:11:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc6d88a0e6b8593cae5681a7606846fe SHA-1: f38419186a9393d549a21f6887cb93a3831d1f86 SHA-256: 3d1160a23d0cb4eab0ee52425fa245c0f155c91e247d7db3323879266c4d1438
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to Weebly-hosted PDFs with numeric slugs, indicative of a link farm or SEO manipulation. ClamAV and ML classifiers flagged this as malicious, specifically as a phishing trojan. The embedded URLs suggest an attempt to redirect users to potentially malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wb?keyword=lava%20hd%208008%20omni%20tv%20antenna%20review
    • https://xumusozopojuvuj.weebly.com/uploads/1/3/1/3/131398507/ae0f7.pdf
    • https://fadafiwu.weebly.com/uploads/1/3/5/3/135302778/9903578.pdf
    • https://bisowepot.weebly.com/uploads/1/3/4/5/134598436/6768992.pdf
    • https://fagutefoxod.weebly.com/uploads/1/3/4/2/134235025/zobudexujude.pdf
    • https://koxufujemugipad.weebly.com/uploads/1/3/0/7/130739729/ad8c8.pdf
    • https://netodidomaxamoz.weebly.com/uploads/1/3/4/3/134311991/wakuzezumosuma.pdf
    • https://bogexisamalalu.weebly.com/uploads/1/3/5/3/135320210/237272.pdf
    • https://supuzuvafexag.weebly.com/uploads/1/3/5/3/135383103/zipikagexuboxo.pdf
    • https://vebazefi.weebly.com/uploads/1/3/4/0/134040586/6181485.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2951d6af-96a6-424d-beae-934a2e7f3c2c/91617927027.pdf
    • https://uploads.strikinglycdn.com/files/d01aec27-08b3-425c-a819-1f0fd9f2a5fb/how_to_program_chamberlain_wireless_keyless_entry_system.pdf
    • https://uploads.strikinglycdn.com/files/333550f5-b1b4-493b-b626-6d90783450c1/warcraft_iii_remastered_release_date.pdf
    • https://uploads.strikinglycdn.com/files/2218edf4-096c-4db9-9b38-b77d896025b8/watch_agneepath_1990_full_movie_free.pdf
    • https://uploads.strikinglycdn.com/files/d64eeb86-feb5-4f75-93de-c008326eb00d/wukufegogigamapov.pdf
    • https://uploads.strikinglycdn.com/files/3a502bc6-2b0a-45db-89f5-96329dc823db/list_of_synonyms_and_antonyms_for_7th_grade.pdf
    • https://uploads.strikinglycdn.com/files/dc91dcec-a259-44ac-9661-34a14998bd6f/2016_ap_calculus_ab_free_response_answers.pdf
    • https://uploads.strikinglycdn.com/files/191964a6-6d38-4ac9-b25b-1e1d60f9902a/bedtime_stories_age_rating.pdf
    • https://uploads.strikinglycdn.com/files/60b42e64-4537-41c0-bc0a-c75d36470f30/pinabexomiwagufu.pdf
    • https://uploads.strikinglycdn.com/files/62322eac-f5d9-4e6b-be26-e6f59145f8bb/how_long_does_it_take_to_charge_the_mophie_powerstation_xxl.pdf
    • https://uploads.strikinglycdn.com/files/73ccc500-a0aa-461e-8082-73b2ca0e9695/soxukufafodugeriji.pdf
    • https://uploads.strikinglycdn.com/files/bb36bebb-ee6f-4b45-bcf9-79dda07f0b3f/3384907269.pdf
    • https://uploads.strikinglycdn.com/files/455065c6-03e4-43a0-8040-4ab0eca1bf50/80397150873.pdf
    • https://uploads.strikinglycdn.com/files/049ecf72-f71a-46ca-b814-0a9d74594c3a/jemewarezodusu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc49.bin
8abddaf281945e16edb3f08031054c77d48431af3670c9ec8c0381fafe861c6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC49 5284 bytes
font_01_sfnt_off00010e2e.bin
37c81a7be2a4bc0d0378a356b3f0afdc45e10072b12baad26a67ee53f1dffc74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E2E 11252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.