Malicious PDF — malware analysis report

Static analysis result for SHA-256 423b55ae10892783…

MALICIOUS

PDF

94.0 KB Created: 2021-03-01 21:00:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: e467b7282957e8d1128c8bc93901a04a SHA-1: 760ea852f6002e2079b0b1602e1e6e3dd6ca8b01 SHA-256: 423b55ae108927831a2c954499fa4d8cbbeff4ea39db9acbfc815e260d1a02ff
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which are disguised as PDF downloads, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a tactic of directing users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=eragon%2527s+guide+to+alagaesia+pdf+free+download PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4409421/normal_5ffd544d53c53.pdfIn PDF document text
    • http://potawuzaj.medianewsonline.com/dewalt_733_dust_collector.pdfIn PDF document text
    • https://cdn.sqhk.co/lepowabog/L6ji6gd/finojisi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4502567/normal_5fcda33561964.pdfIn PDF document text
    • http://zoguponuwuxoli.medianewsonline.com/how_to_disable_viper_car_alarm_without_remote.pdfIn PDF document text
    • https://cdn.sqhk.co/dasofuduveje/ujgjd0a/ninja_turtles_names_and_colors_and_personalities.pdfIn PDF document text
    • http://xuxijosut.sportsontheweb.net/59420792889.pdfIn PDF document text
    • https://cdn.sqhk.co/petebeki/iieBjgr/desesimewed.pdfIn PDF document text
    • http://vibolofisef.mywebcommunity.org/gegafufuzapowenevefa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447487/normal_602051046c50d.pdfIn PDF document text
    • https://zegepefuloruwan.weebly.com/uploads/1/3/4/0/134012378/wutuvome-rinub-gusekininifexi-xezesodimojamow.pdfIn PDF document text
    • https://cdn.sqhk.co/besogevipadi/wihV9cL/jugukasewivedesoxavoga.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382189/normal_602577b9af943.pdfIn PDF document text
    • http://sitebomobegux.sportsontheweb.net/32879635589.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402718/normal_6006a74451f49.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4406812/normal_5fcf806c0c85d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459058/normal_5ff69f5b92b47.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390056/normal_600559c23cab3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374976/normal_5ff963f3c7104.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0F7 17236 bytes
SHA-256: 5fe873d92c5f8c9b0aa77f176db350402c712ee783400a3c14c1d694bb5dd63c
font_01_sfnt_off000127ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x127AD 5292 bytes
SHA-256: e274201cacd61a19dc620fbc7e35aec46607cdcd7534c01548443c7107d2eae6
font_02_sfnt_off000139d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x139D4 14744 bytes
SHA-256: 709ed55058e46aaa7969a9709b3d42befb04d36c3957a9f056ac0595de573542

Open this report in the interactive analyzer, or submit your own file for analysis.