Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fb01a19fc4ceb9a…

MALICIOUS

PDF

83.8 KB Created: 2021-01-08 19:49:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6bb8fd2d6b21ee6dba23a4609acb853b SHA-1: 7a00fad1c7b8c1d9a3f6fcb8295d7c4d3512cdb0 SHA-256: 3fb01a19fc4ceb9a60ec780de3d6bd591ce0afa56cabb53c256a65576d01e3d1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by multiple heuristics and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, many of which are to unknown domains, suggesting a link farm or phishing campaign. The presence of embedded URLs and the overall structure point towards an attempt to redirect users to malicious sites, potentially for malware distribution or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=technical+analysis+pdf+in+marathi
    • https://cdn.sqhk.co/vogoxaginoje/yihicmo/battery_plus_bulbs_pearl_city.pdf
    • https://kadutazufe.weebly.com/uploads/1/3/4/6/134639852/zujogodezo.pdf
    • https://cdn.sqhk.co/fawabanof/ggjgnI8/r-_type_tactics_ii.pdf
    • https://cdn.sqhk.co/sirejeforox/GghlBJt/93355496519.pdf
    • https://bejasesazopo.weebly.com/uploads/1/3/4/5/134512805/xapune.pdf
    • https://cdn.sqhk.co/pomorezolo/djiPxjj/snowflake_drawing_easy.pdf
    • https://dubuzosokiboxof.weebly.com/uploads/1/3/1/1/131163723/6588788.pdf
    • https://zopoxetofosifa.weebly.com/uploads/1/3/4/8/134863155/a7b7bb5ba.pdf
    • https://bufamugogok.weebly.com/uploads/1/3/3/9/133986728/0712d567d76e03a.pdf
    • https://cdn.sqhk.co/befozaxulot/kij6hbk/dutifavol.pdf
    • https://cdn.sqhk.co/pasepizut/XGkzqKv/95476978551.pdf
    • https://kirewigofe.weebly.com/uploads/1/3/4/3/134382955/ff423938999.pdf
    • https://cdn.sqhk.co/butiluluvuk/hapFria/sword_sharpening_sound.pdf
    • https://lexawuvake.weebly.com/uploads/1/3/4/6/134610488/081ef2b08f.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/e4b72d98-88e4-42c1-8d14-f6123cfcf595/garmin_nuvi_265w_map_update_free_download.pdf
    • https://uploads.strikinglycdn.com/files/3929c9be-6e5d-402a-acb3-a37164fdf0c5/xekozatepirevikimeg.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c7d1.bin
8678461a36318f73caa47be7720532798183d8a18b717e055a12ae2b3be44fb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC7D1 1528 bytes
font_01_sfnt_off0000cf98.bin
f97da39d466bbb04f718cbc2b53a79c898b2e1530fa75aa321a4ff67e7ff4134		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF98 5444 bytes
font_02_sfnt_off0000e200.bin
421bc722b06ccc20d02c3c6609624541e3f0e8fd43ad37c74af645c07d8c1ff8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE200 11404 bytes
font_03_sfnt_off0001090d.bin
9cf254e0ce56bd3c854ae11e6182fbd130efd6dd23b88c144db79241a7da16a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1090D 16304 bytes
font_04_sfnt_off00011f01.bin
4239785ef3c2adb9f11de0ba099b2ab2660f22d28fa7a998ef6bd968aa10080a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F01 10756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.