Malicious PDF — malware analysis report

Static analysis result for SHA-256 463f25d755811516…

MALICIOUS

PDF

78.8 KB Created: 2021-04-02 00:46:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6649371432fc8405f4420a74f2d66d15 SHA-1: 5d8768445e32f39869db13db59a7826243f6b99a SHA-256: 463f25d7558115160115ed9e2267fd652584929aaf4d23785502bd1efb29d26b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of a large number of external links, including a link farm, suggests an attempt to redirect users to potentially harmful websites. The file's structure and the embedded URLs point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=fundamentos+de+marketing+11+edici%25C3%25B3n+kotler+%2526+armstrong+pdf
    • https://cdn.sqhk.co/robimovule/ySaaShe/fapekuvexumamape.pdf
    • https://cdn.sqhk.co/kutajanode/igiaiDN/34304037570.pdf
    • https://cdn-cms.f-static.net/uploads/4413012/normal_605a4ba57d984.pdf
    • https://static.s123-cdn-static.com/uploads/4382771/normal_5fde9dac574d6.pdf
    • https://cdn.sqhk.co/mixaluwekitu/gfkjdxL/xemutuwipuzopaxazi.pdf
    • http://volulolusawaz.mygamesonline.org/fepanuninema.pdf
    • https://cdn-cms.f-static.net/uploads/4445550/normal_5fd83de3c8db7.pdf
    • http://bazunujovi.scienceontheweb.net/31156463978.pdf
    • http://fubikopelemom.mypressonline.com/cavite_mutiny_tagalog.pdf
    • https://static.s123-cdn-static.com/uploads/4381738/normal_5fe1344fdffd6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3dff12a8-9406-4a3d-8bf2-db9db25d0b5f/7953030953.pdf
    • https://b24036c1-08f6-4d5b-b8c9-f4c47f26e437.filesusr.com/ugd/ae9acc_b01b0d9288d4454ea94aeb9130dbe560.pdf?index=true
    • https://uploads.strikinglycdn.com/files/44bad4c6-1d61-4a28-844c-bf96c4b12fd1/jack_lalanne_fusion_juicer_warranty.pdf
    • https://uploads.strikinglycdn.com/files/83af432c-5e96-48e9-9127-eadce57f0a3c/lulujusefadobudod.pdf
    • https://uploads.strikinglycdn.com/files/deb6f5bb-4d97-4ee9-95bb-8c3f10dee78a/do_churches_do_marriage_counseling.pdf
    • https://uploads.strikinglycdn.com/files/807ecd95-ea8d-43cc-97c2-c1885301c017/how_to_fight_climate_change_as_a_student.pdf
    • https://7162f0c1-3bb2-4775-9ad2-1e34613fb889.filesusr.com/ugd/595093_5fcf4f23e34d47c4b12e359aa0ca3c9a.pdf?index=true
    • http://vigavanoxe.onlinewebshop.net/69247633682.pdf
    • http://saxodanokijaj.atwebpages.com/how_to_do_crochet_box_braids_on_short_hair.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f47d.bin
5b11a15d908ca765f4ea52a732167afd47940d1758021e5ae0baceb71bca1d3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF47D 5464 bytes
font_01_sfnt_off000106c9.bin
006825cdd381edf4c7fac3d3a57b08a404b751b646d73f308aeac41f208c8e8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106C9 10764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.