Malicious PDF — malware analysis report

Static analysis result for SHA-256 471dedb3f1d78737…

MALICIOUS

PDF

85.6 KB Created: 2021-04-06 17:40:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e7faded05d1be61291723898ccca4851 SHA-1: e045fd7a96e402dca9fd4ac7d6dd1121a50e5673 SHA-256: 471dedb3f1d78737666320367bbcf8383c1a151092744992d74cdb10a6e595a6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for Pdf.Phishing.Trojan and an ML classifier indicating maliciousness. The PDF contains a large number of external links, suggesting a link farm or SEO manipulation tactic. While no scripts were directly extracted, the presence of external URLs and the phishing/trojan detection strongly indicate a malicious intent, likely to redirect users to phishing sites or download further malware. The document body is heavily obfuscated and unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=estadistica+descriptiva+ejemplos+resueltos+pdf
    • https://cdn.sqhk.co/lopijikuvi/K9gghja/irancell_gp-_2101_td-_lte_modem.pdf
    • https://cdn-cms.f-static.net/uploads/4371497/normal_603bf835e6ed5.pdf
    • https://cdn-cms.f-static.net/uploads/4371266/normal_60215b943cb9b.pdf
    • https://cdn.sqhk.co/pigevikuwi/iilPij2/boss_fight_music_download.pdf
    • https://cdn.sqhk.co/vorinugobol/idibggh/ballin_on_a_budget_sticker.pdf
    • https://cdn.sqhk.co/kuniremolu/ihZiggi/lonigazamufolabakuribami.pdf
    • https://cdn.sqhk.co/bulixanejad/ggxhghh/megatroid_mod_apk.pdf
    • https://cdn.sqhk.co/nipigagavadu/bpcABh3/rainway_vs_parsec.pdf
    • http://zejazan.iblogger.org/allelopathic_effect_of_weeds_on_crops.pdf
    • https://cdn.sqhk.co/bokupajokim/jgfhjHh/dejepetoledokur.pdf
    • https://cdn-cms.f-static.net/uploads/4412606/normal_60393b2657f42.pdf
    • https://cdn.sqhk.co/rumoligodo/eUOSxE9/zinagabedosewefuso.pdf
    • https://cdn.sqhk.co/bogovureg/gfjF7Hq/99471749375.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3abcc933-4059-444f-8e65-7077e95f005f.filesusr.com/ugd/44645f_f753733fe17f4fc1a6618e29f4f801e8.pdf?index=true
    • http://tunufefenus.rf.gd/icewind_dale_2_custom_portrait_size.pdf
    • https://5c09c65f-4728-49e3-9562-8692e696fc4f.filesusr.com/ugd/32acb1_3b58e91a06d8497fa5bf300640c4ebe2.pdf?index=true
    • http://kidagemomosate.epizy.com/anti_nmda_receptor_encephalitis.pdf
    • https://425e2ee7-996f-4c6d-a593-b44a2a39b733.filesusr.com/ugd/bb05c1_e926fdff522b4bad80e54843b84acaa7.pdf?index=true
    • https://6c71f620-b6e5-46cc-9e58-526c5f0a7a41.filesusr.com/ugd/1c90dc_103081f9795f43338ec48bd2fcbaae74.pdf?index=true
    • https://e1318bff-d970-45e2-bcea-45481503a18b.filesusr.com/ugd/75a96d_9ccd5584624f4d43a27da11bfa626129.pdf?index=true
    • https://bff5fdab-9fd0-4670-908b-a1308bb5a9cb.filesusr.com/ugd/227d0f_39c153f4243c453eb522882c4c2a8632.pdf?index=true
    • http://xujiwusa.epizy.com/career_coaching_handbook.pdf
    • https://efa91360-7c21-416c-9d60-3189e0beb381.filesusr.com/ugd/42ffc7_88870de190a94c468f754d1b9eeb7137.pdf?index=true
    • https://8458b573-1d6d-478c-912c-b10a972f31df.filesusr.com/ugd/150112_f6d7a797043c46029daf955c577f5818.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f416.bin
c51525d073c0ec9d9a67a3d7fc63151c4d15ec5608334100771f6b42c09a70e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF416 5392 bytes
font_01_sfnt_off0001066c.bin
c4df7e0fcfc26ce0970174fdc212097c0ab2ebd2ffb21d0a4e6ccf425bcf7324		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1066C 12700 bytes
font_02_sfnt_off00013059.bin
bf9c1f19bd9ec46a4cf43d005e3092a291489eb77df00e9c6b47029d2cf964a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13059 16340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.