Malicious PDF — malware analysis report

Static analysis result for SHA-256 4710c0640dd6d791…

MALICIOUS

PDF

73.2 KB Created: 2021-03-06 16:21:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 08675dfa7fda90ff8fdf06c28368916f SHA-1: ef88bac89446faf1c581ebfee8e35e181d00afef SHA-256: 4710c0640dd6d791b8938b740ea4083ae853269d973755bf0e6ae489ca7930f5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is classified as malicious by ML and ClamAV, indicating a high likelihood of malicious intent. The document contains a significant number of external links, with a critical heuristic identifying it as a PDF link farm. The primary lure appears to be a 'how to wrap a gift' theme, which is likely a deceptive tactic to encourage users to click on the embedded malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/aws?utm_term=how+to+wrap+a+gift+easy+steps PDF link annotation
    • http://itwomen.space/are_lady_gaga_and_bradley_cooper_friendstecwv.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372972/normal_6003bcb6071ae.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409258/normal_5ffbd6a291d86.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404984/normal_5ff466148c5a6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405430/normal_5fe005c5b4a05.pdfIn PDF document text
    • http://idealicaitalia.website/5369716422fbx1k.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://5b3fc17b-a4fb-4144-9a53-ff617e35bc6a.filesusr.com/ugd/696117_407bf687129c47f1b5c56f2d9a020572.pdf?index=trueIn PDF document text
    • https://1e1f235d-56dd-4976-b20d-d38e3fe7b172.filesusr.com/ugd/210b45_1f8df441785e44ce83606f0814c37f02.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/248257f8-58a0-4be9-ade0-4968163d55c3/79267778614.pdfIn PDF document text
    • https://510b81f6-be4e-4e40-9acf-3f60af495837.filesusr.com/ugd/5f226b_059083a29dc74b6eb7dfaa14c5ded248.pdf?index=trueIn PDF document text
    • https://849bdae7-2456-4570-9e2a-fc769e7e49ad.filesusr.com/ugd/2074c9_f11b9646406a41bf94a3edbe6cc63fbe.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a65fa1a-09ed-4708-9a13-deee8a2af6aa/wekuvufagomaled.pdfIn PDF document text
    • https://s3.amazonaws.com/farezelof/44241140537.pdfIn PDF document text
    • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_401fb300221e493a9733dc04c5eee0b1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lupebesu/11740881915.pdfIn PDF document text
    • https://dba0ca6b-c979-46b3-87c9-041648dee063.filesusr.com/ugd/6f58fb_2b35b6fb8ed14e06974bfbc7be79bcbb.pdf?index=trueIn PDF document text
    • https://02687da8-bf2b-436b-a8ca-82c6e04513a5.filesusr.com/ugd/e48f8a_b7f60677e45b43abbc74d18047f66569.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/129fcbc0-99cc-4b6a-a77d-52cd6c7bfa88/zulewewilezubawozo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e097.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE097 5192 bytes
SHA-256: 431cefe8fe137a0462325addb6e4ff411e576b77e7ac659f5309e5f619fac7c5
font_01_sfnt_off0000f26f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF26F 11088 bytes
SHA-256: 99a142fdef62f788b0670a374147e00b375a00cd795070f0f7ffc3aefe5a3c2e

Open this report in the interactive analyzer, or submit your own file for analysis.