Malicious PDF — malware analysis report

Static analysis result for SHA-256 400c91df33443b88…

MALICIOUS

PDF

80.8 KB Created: 2021-03-19 08:22:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a65e0a7d044cbc0e292a52d145b0bf8 SHA-1: 51638f694ec0ebc171e91ac3888cc3bbdac9441b SHA-256: 400c91df33443b88ee930ce4ca3433b0eed4b9bcfc70e21ffae10a32bdf10c02
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-optimized, suggesting a link farm or phishing attempt. The 'SE_CALLBACK_LURE' heuristic indicates a potential callback phishing or tech-support scam pattern. While no scripts were explicitly extracted, the PDF structure and the presence of external links point towards an attempt to redirect the user to malicious content or gather information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=best+defense+lawyers+in+melbourne
    • https://dobopekajami.weebly.com/uploads/1/3/4/3/134314215/1973568.pdf
    • https://povijovo.weebly.com/uploads/1/3/4/4/134463476/8d39bf1445.pdf
    • http://1xbet-sportstavki.fun/download_hebrew_bible_with_english_translation2l5hz.pdf
    • https://zademufexek.weebly.com/uploads/1/3/4/7/134765537/8c3d23b.pdf
    • http://grizhoff.ru/mario_kart_descargar_para_pc4693n.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://5de9ed01-d610-4143-94db-6f998645a8ce.filesusr.com/ugd/1d8bf6_2a238f8635084724ae5667bbd54b6144.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9a486318-1690-4f09-acf1-7a64439a090e/what_are_the_primary_objectives_in_studying_philosophy_of_man.pdf
    • https://46ebecaa-9490-439b-bba6-ee77f1a6ca93.filesusr.com/ugd/cee8a1_a6c1a9e3210546889659380e308725d9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f113a555-c917-40e4-9fcc-31f3e11877d9/kiwid.pdf
    • https://8772a198-af03-49ef-8724-5feb7546cb8a.filesusr.com/ugd/436f04_f10951218be54ad5b7ad81bdbf44f437.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4d088ca0-3b79-4186-8bda-8cff3eae50f7/rapibe.pdf
    • https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_1ee5974ac3474d12bf8348c83895b9d3.pdf?index=true
    • https://af30af13-e0b7-4de0-aca7-7783c01eade2.filesusr.com/ugd/9757e7_dfcffc5840754c83af7a72bf6b238912.pdf?index=true
    • https://44879a12-c10a-431c-a98a-7de142752d0f.filesusr.com/ugd/bb4607_c37a878ea490478ea931911921efbcc6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/af8a877e-abee-4403-ae9d-4ea8bdce3e46/the_prince_kiera_cass_summary.pdf
    • https://uploads.strikinglycdn.com/files/7b916587-f663-497b-a866-273252bb942a/52825166965.pdf
    • https://uploads.strikinglycdn.com/files/40a9e49f-aff4-4d46-85bd-d570884b9497/saxivufajibuzuxadikoga.pdf
    • https://uploads.strikinglycdn.com/files/9411633e-602b-4e9f-a4c0-84cbbed83a81/the_bear_william_faulkner.pdf
    • https://uploads.strikinglycdn.com/files/f9056738-a71c-480f-9109-8e360c361a23/how_many_calories_are_in_a_sonic_cherry_limeade.pdf
    • https://748f1d53-d141-46c1-926a-d14fc69713a3.filesusr.com/ugd/e3ed1f_3a5c112e27934039af0f844e7e91b6f4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efb5.bin
5b475afc2e31fc89ab63e468eeeb98eb42beb6e08ce82b789488f2048bad4291		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFB5 5316 bytes
font_01_sfnt_off000101c1.bin
af7ad8a54a8ca97a291bab470017328a88470bb62b6aa759dfb9d3d4c04aa032		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101C1 11220 bytes
font_02_sfnt_off000127d7.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127D7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.