Malicious PDF — malware analysis report

Static analysis result for SHA-256 428a2c38cc9b6ae6…

MALICIOUS

PDF

87.3 KB Created: 2021-03-23 10:19:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 36f3439b8378a48775aa56b10eb351f0 SHA-1: 37bb22f01b1866e06032b7f7955ba12850bd2504 SHA-256: 428a2c38cc9b6ae68a7c0c59879c4e64f3f2a5f1d378f63cfe56fccbcd0d22dd
146 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of a lure to enable macros or editing suggests it's designed to trick users into executing further malicious code. The embedded URL points to a domain associated with link farming, potentially serving as a distribution point for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=mann+kendall+test+excel PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4455197/normal_6058c528b0bb0.pdfIn PDF document text
    • https://cdn.sqhk.co/jivonaxadu/fig0iea/download_lagu_alan_walker_greatest_hits_full_album.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461216/normal_6004ab1ae3f1c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475215/normal_5ff2cf0f039c6.pdfIn PDF document text
    • http://amst-watch-v2.club/fegasarofufagw91h.pdfIn PDF document text
    • http://damvglaz0.xyz/excel_project_management_gantt_chart_template_freegxrsr.pdfIn PDF document text
    • https://cdn.sqhk.co/winogolelog/ybL3Lig/niwidovunupi.pdfIn PDF document text
    • http://3gusevshop.space/71921551551ujv29.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404103/normal_5fd1cef9928c9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416322/normal_5fe29efe3e1a7.pdfIn PDF document text
    • http://smartline58.ru/776365767948f119.pdfIn PDF document text
    • http://vilopeg.xyz/xofifamemumejivokitim8ivr.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://eecb1da5-82b7-48ef-90e5-6a20895c07e7.filesusr.com/ugd/88a84f_a195ff2d919d4eabbf893e0ae9cbb6cc.pdf?index=trueIn PDF document text
    • https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_3db5f3b5953244769eabb1944817b7ac.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6479bb95-9903-49bc-8b88-c2c6e53182bb/apple_bluetooth_keyboard_pairing_samsung_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/958988e8-8f34-44fa-bd19-cba80137a191/three_body_problem_book_4.pdfIn PDF document text
    • https://cd753cf5-d90a-4073-9c55-931a76e81761.filesusr.com/ugd/8826df_dc74db0765ce41e4b4205219228c8848.pdf?index=trueIn PDF document text
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_8989ae5ab5db404fabb558ae111cccf5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b62df60-916f-430a-9748-3fcdd47c7e60/the_killing_joke_ending_joke_quote.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6479485-0aa0-45cd-bcbd-ed711347ada1/class_11_maths_book_download_state_board.pdfIn PDF document text
    • https://d3df31c7-72fe-42b1-a92e-0723e8ed7a16.filesusr.com/ugd/5bf82b_abf2457c05f842b09ce18e6fd2272bdd.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f505.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF505 4604 bytes
SHA-256: 3b4718a19adb794ed87a95fda60f39f19be1fda95806aa24e2ec00b05082b8cd
font_01_sfnt_off000104b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104B4 11344 bytes
SHA-256: abfa9372571fbf107a8c72e76603d9d0880fa328ec8cbc99982076a04081e610
font_02_sfnt_off00012ba7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12BA7 16320 bytes
SHA-256: ec02678b837a9fdbd2f52941658c4431f0417f92feca2a441b04ca3869686dcd
font_03_sfnt_off0001415a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1415A 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.