Malicious PDF — malware analysis report

Static analysis result for SHA-256 406339fc3c465555…

MALICIOUS

PDF

79.0 KB Created: 2021-03-20 11:18:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 98178d98a9d142b4fd88b94ac9fa0271 SHA-1: 2aa2164806ec4e5d7b6c99651eadfe6ee5255f27 SHA-256: 406339fc3c465555fe16e4147a2d9053c42a2a553d5e3b8dc7a2614ee28046b3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file is classified as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains a large number of external links, suggesting a link farm or redirection mechanism to malicious sites. The document body, though partially corrupted, references "Bergentr kung piano sheet music" and includes metadata from wkhtmltopdf, indicating it was likely generated to appear as legitimate content while hosting malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=bergentr%25C3%25BCckung+piano+sheet+music
    • https://static.s123-cdn-static.com/uploads/4413239/normal_600574ab7c8f2.pdf
    • https://cdn-cms.f-static.net/uploads/4413345/normal_6041b76790d45.pdf
    • https://static.s123-cdn-static.com/uploads/4493541/normal_5ff4a67befc11.pdf
    • https://cdn-cms.f-static.net/uploads/4369179/normal_60494212c3547.pdf
    • https://cdn-cms.f-static.net/uploads/4477379/normal_6040579b36375.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c6926203-1eb9-401e-9afa-11f61f201807.filesusr.com/ugd/685707_8e9a7937783f493bb261823ae9605300.pdf?index=true
    • https://s3.amazonaws.com/silubebebefuju/75410597807.pdf
    • https://dba0ca6b-c979-46b3-87c9-041648dee063.filesusr.com/ugd/6f58fb_920b87ce69854df38901c0230a69addd.pdf?index=true
    • https://78f121e6-5824-477f-9480-4bf23eba804c.filesusr.com/ugd/9564ad_022fd8314e0b4a7d9738a3df0c64c5cf.pdf?index=true
    • https://933afb0c-60ca-4ff4-ba38-e7c804ca925d.filesusr.com/ugd/941881_cb4f006c059c41d29cf0f059b5145d31.pdf?index=true
    • https://fbaba6ab-37cf-477f-82bd-e10a416eccda.filesusr.com/ugd/3c8574_f8581ac9e2df4289bd3cefdb4bf3d2ef.pdf?index=true
    • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_7671f192b9264a67b0c0a5edf770b6c8.pdf?index=true
    • https://s3.amazonaws.com/zozuxukoxo/dijaroga.pdf
    • https://03f57db0-fbcf-46ec-8713-21b5992b8512.filesusr.com/ugd/455f95_53d4f648706e412a84b7b304935ad444.pdf?index=true
    • https://4a31e3f8-49e3-4331-b1a9-c0bb7a6b9dbc.filesusr.com/ugd/599f1c_0f0df1c1e68b4c56b8e7b097f4505844.pdf?index=true
    • https://s3.amazonaws.com/jutenojamega/calculator_vault_latest_apk.pdf
    • https://c216880a-03a2-4774-ab7e-121c93799e8f.filesusr.com/ugd/b5aed9_9d0cfa610b4a4166b7707cd21f063833.pdf?index=true
    • https://s3.amazonaws.com/tojabixefova/jivenunofolamedadikanapi.pdf
    • https://s3.amazonaws.com/xifabilejilab/wenedezeledisew.pdf
    • https://6f0a1f77-3195-4c90-aae7-8e5805bb56bd.filesusr.com/ugd/f94fd0_67d481130cfc4f9a8115ac12cb853481.pdf?index=true
    • https://s3.amazonaws.com/nalifij/jazunolexod.pdf
    • https://233b4d2f-9c44-4004-b776-098ebc281e6f.filesusr.com/ugd/7f980c_a3a85f3814b8429285f808936bf3f7ca.pdf?index=true
    • https://s3.amazonaws.com/lebaxa/simple_compound_and_complex_sentences_worksheets_grade_3.pdf
    • https://s3.amazonaws.com/jixerubowi/57450393403.pdf
    • https://6afed14e-2b01-442b-8c2e-11a8a6f39965.filesusr.com/ugd/46a5ae_2220505d2048482ab9d6a21190311892.pdf?index=true
    • https://s3.amazonaws.com/wulagisi/95771149166.pdf
    • https://cef8af8d-7071-4339-ac50-fc417d371010.filesusr.com/ugd/a89196_bb28129d75f04d10bdfe123a80fbcf91.pdf?index=true
    • https://s3.amazonaws.com/wezukep/sotoguroda.pdf
    • https://fad58b31-c538-4d3f-828d-7998eec853b9.filesusr.com/ugd/7e6083_05f2eeb86258401cbcd337868743ef44.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4dd.bin
d77c769dbf8a646b868dc0bc2da516ec6c636da375d2dcb4e282ec64c22d2076		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4DD 5548 bytes
font_01_sfnt_off00010768.bin
2fdb1d779ee1f5eb1f67ac3c8a50d5d731e999334bdaa86a40e74595468dff00		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10768 10748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.