Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e647397e5cdaa1c…

MALICIOUS

PDF

86.4 KB Created: 2021-03-16 09:36:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 4e2fcf8d3f32ecb364ab6c4409bfe982 SHA-1: 22e6e796d0bd948e3f08157fbcd5b3c4b912a9ed SHA-256: 3e647397e5cdaa1c37c3938cd9e10fdf10d54ea3e2521eaef0f450dd079a90d0
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are likely part of a link farm designed to improve search engine rankings for malicious content. The presence of a 'download button' heuristic and ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a phishing or malware distribution attempt. The embedded URLs, such as https://jottigo.ru/strik?utm_term=graphic+design+software+free+download+for+windows+xp, are likely used to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=graphic+design+software+free+download+for+windows+xp PDF link annotation
    • https://cdn.sqhk.co/rizinutix/z8QYkig/elefantul_cici_negativ.pdfIn PDF document text
    • https://cdn.sqhk.co/telapunojawu/hdpjyyj/vuzavuli.pdfIn PDF document text
    • https://cdn.sqhk.co/tenotitur/hbWhb0P/recarga_facil_claro_chile.pdfIn PDF document text
    • https://cdn.sqhk.co/levowexesu/dja3ibV/60764971703.pdfIn PDF document text
    • https://cdn.sqhk.co/ninoporaleva/GXihijj/chess_master_game_online.pdfIn PDF document text
    • https://cdn.sqhk.co/zuxolusufa/1aTjjhc/41171060989.pdfIn PDF document text
    • https://cdn.sqhk.co/bimazizuxu/AjdBkgf/wujatineb.pdfIn PDF document text
    • https://cdn.sqhk.co/geruvijiwiw/Jjgoger/chicago_manual_of_style_cover_sheet.pdfIn PDF document text
    • https://cdn.sqhk.co/dudexobexine/eYghyhb/36347214600.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fifomi/wuzamogevupafijagajul.pdfIn PDF document text
    • https://2dc0326d-ac60-47d8-bf46-f2dc9d334570.filesusr.com/ugd/21b4a7_088b35b352034f6086cf618162c69bc7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wemupajese/besevigetowebevi.pdfIn PDF document text
    • https://41be308f-8a64-4dec-8b30-4937605be974.filesusr.com/ugd/f042fe_1b39ed831b80445b9c19d4839bef2036.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/jedemiwotedarosixefumezav.pdfIn PDF document text
    • https://s3.amazonaws.com/guvovigo/28060584392.pdfIn PDF document text
    • https://86042ffc-9b62-460b-8552-fb2522205a17.filesusr.com/ugd/4f92c1_31f036c5ae4e443485d2506dc903d84e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mexijegedakol/bloomberg_professional_app.pdfIn PDF document text
    • https://s3.amazonaws.com/zubata/affidavit_format_legal_heir_certificate.pdfIn PDF document text
    • https://d8d078ea-10ec-4787-8e21-ef6e32b87a24.filesusr.com/ugd/8f6098_1682f5d6ec834bd9a340b0b905c1ebd7.pdf?index=trueIn PDF document text
    • https://ac6a5e95-3fab-4d4b-a7e7-0ef4c71e5929.filesusr.com/ugd/32c278_2ebf06aaee5040daadaea55bd134248f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fusopoxipo/area_of_a_trapezoid_word_problems_worksheet.pdfIn PDF document text
    • https://460eb545-5389-4aa9-9e78-d1074a8bca0c.filesusr.com/ugd/21a131_1484852a194a4a8a9d2c1627d180aa7d.pdf?index=trueIn PDF document text
    • https://6c71f620-b6e5-46cc-9e58-526c5f0a7a41.filesusr.com/ugd/1c90dc_6e9e71b7b97c4d0b843590dda223bd97.pdf?index=trueIn PDF document text
    • https://05f6fcc2-a4c7-4d5b-b58c-97b640a93f4d.filesusr.com/ugd/74147a_62377e2ce76148ddaa11a7880846c802.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bokexizometun/pesikunapiz.pdfIn PDF document text
    • https://s3.amazonaws.com/vonutavekip/masked_singer_season_2_performances_leopard.pdfIn PDF document text
    • https://bdee3e82-1fe6-4084-b289-f15f5249f83e.filesusr.com/ugd/749937_30e61a12822b48daa466fbd3d6b58f46.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001145a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1145A 5608 bytes
SHA-256: 8fc5ef749524343a96febe3a0b789e03ff2f96bbd9d8dad8686cc21b887d4aab
font_01_sfnt_off00012784.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12784 10600 bytes
SHA-256: a8b92ae11f7965c6b8dcd5c82aa86d10b3f00f2cfa3a792917f916c5043c551c

Open this report in the interactive analyzer, or submit your own file for analysis.