Malicious PDF — malware analysis report

Static analysis result for SHA-256 4197767583e29102…

MALICIOUS

PDF

82.4 KB Created: 2021-03-23 10:20:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 843e3d54b81edbbe6114e5c0b5c7aeb1 SHA-1: e2977a6f1f0114a3e1bdbc313cd5653267aa7612 SHA-256: 4197767583e2910284eaffb4ab08f777592cfc835ce5d2f08c3ecd2bee0131a8
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by multiple heuristics, including a critical ClamAV detection and an ML classifier. It contains a large number of external links, many of which point to potentially malicious domains, suggesting a link farm or phishing attempt. The presence of embedded URLs and the 'Urgency / deadline lure' heuristic further support a phishing or malicious redirection scenario.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=is+game+of+thrones+books+done
    • https://cdn-cms.f-static.net/uploads/4486772/normal_60149f04aa592.pdf
    • http://indohealth365.online/the_hammer_of_thor_read_onlinel7cxl.pdf
    • https://tetunabirudav.weebly.com/uploads/1/3/0/8/130874278/2113033.pdf
    • https://cdn-cms.f-static.net/uploads/4420434/normal_6021833b3b34e.pdf
    • https://rukepeninosiwul.weebly.com/uploads/1/3/1/4/131406291/6128062.pdf
    • http://nickned.me/gufutojizamemetefebamabuuqytn.pdf
    • https://sanevofodi.weebly.com/uploads/1/3/0/9/130969150/5083d4d3cacf77a.pdf
    • https://static.s123-cdn-static.com/uploads/4501364/normal_6003a861be4d3.pdf
    • http://requiremcgood.com/essential_english_book_16mrnf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d3ba6e41-1e88-4154-bb92-fbf1af5b4772/fundamentals_of_english_grammar_with_audio_cds_and_answer_key_4th_edition.pdf
    • https://uploads.strikinglycdn.com/files/e01babe4-52a7-4bd8-938a-3e5189124da1/poetic_edda_audiobook_free.pdf
    • https://6f2fb29c-15f2-4b08-b525-3eb91a7f0a41.filesusr.com/ugd/c3548c_835251ebe4aa4450848ff5b1ad081e77.pdf?index=true
    • https://359ea524-acbf-40a7-8d58-ee96a8f10bc8.filesusr.com/ugd/ca2e76_6dcf2e51c18d4060800e1fddf76e6fec.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d0ec5bd9-fae5-42e8-bef3-ae82e83e9c21/sifofuwadiw.pdf
    • https://uploads.strikinglycdn.com/files/e90309da-8d31-41c6-a928-03455bb70a73/wawurekakolud.pdf
    • https://uploads.strikinglycdn.com/files/eb7b0011-d882-4da4-9c14-fbed41f8cd57/54716332569.pdf
    • https://03f57db0-fbcf-46ec-8713-21b5992b8512.filesusr.com/ugd/455f95_b98f60bbd1a942b0a83edc2c2cfbe9fb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/63ea1dad-e0b9-4459-b601-2d117ecd856d/madidotonef.pdf
    • https://uploads.strikinglycdn.com/files/097601cb-2e0e-4501-a1f9-8f8e769ee20c/apush_final_exam_review_periods_1_5.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000104de.bin
91e0972404dd6fea0432f34604419c7de3605bd211df26d0cabc38fd4eb72887		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104DE 5432 bytes
font_01_sfnt_off0001172c.bin
c5606aea80676ede34074877e0495e06c97d57e6ce3b7f3f0728e6ef40711874		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1172C 11076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.