Malicious PDF — malware analysis report

Static analysis result for SHA-256 42c96a40330004a4…

MALICIOUS

PDF

78.3 KB Created: 2021-03-29 02:08:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d944e8cf6ff5b16c8e1a81aac3d94235 SHA-1: 96bb7a72548171c8cc698d6aac2e009e1c3714a7 SHA-256: 42c96a40330004a4bfd375a9df2a296d578fe7ccdf82882f907194d7cf938431
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'mass external PDF link farm' and another flagging it as a 'Phishing Trojan'. The document body, though heavily obfuscated, contains references to 'Pokemon y emulator' and 'wkhtmltopdf', suggesting a lure to download or access malicious content. The presence of multiple unknown URLs further supports a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=pokemon+y+emulator
    • http://raftgjgr.space/aula_facil_inglesb0je3.pdf
    • https://cdn-cms.f-static.net/uploads/4416501/normal_60596644d901f.pdf
    • http://8gusevshop.website/ragudazizuwuvo4mso0.pdf
    • http://akfb.online/fawuroxunesazetogokijexi653t5.pdf
    • https://cdn-cms.f-static.net/uploads/4444115/normal_601fd3703e8dd.pdf
    • http://eglo.club/the_great_gilly_hopkins_chapter_7_summaryy1cw3.pdf
    • http://loveantravel.xyz/are_black_oxide_drill_bits_good29eqh.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://26c1613e-5d28-4fa3-89cb-3d2c9ab59faf.filesusr.com/ugd/fe83c3_0427115b8cfb464bb4af74e037b14de5.pdf?index=true
    • https://s3.amazonaws.com/lezopobigeza/litepak.pdf
    • https://59cf682b-6680-4a08-8b8d-0472bab64ef7.filesusr.com/ugd/d7d6cd_817347e109d64532a7c06867079143ff.pdf?index=true
    • https://s3.amazonaws.com/bezutu/cheque_writing_software_free_sri_lanka.pdf
    • https://8f0c9b82-9570-4081-bbb7-5e23a534ea09.filesusr.com/ugd/7008f3_adeb52a3e057465f928c40636e7d8e31.pdf?index=true
    • https://s3.amazonaws.com/mefonevimimix/dowogawuxebevusetinitotan.pdf
    • https://7fc1e5b2-1dd8-4457-9de2-3dea1ab9f589.filesusr.com/ugd/fedd61_7628f2cfc3fa455d9cba9dc76f9d9f2f.pdf?index=true
    • https://82e7f058-9c2a-4352-8e65-a162d98cde11.filesusr.com/ugd/ba3c76_e64ab4b9998f454090ba3cd916bd644b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5a5.bin
3be4795f8937c4cac5b54d57458443615e93088a89f5a133402ef280be3b4eb7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5A5 4656 bytes
font_01_sfnt_off0000f55d.bin
8937e2abd866d20325e2a792106303166835a63ada8d9d23d0640f7f1570e8c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF55D 11908 bytes
font_02_sfnt_off00011d33.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D33 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.