Malicious PDF — malware analysis report

Static analysis result for SHA-256 478a94e1da81b854…

MALICIOUS

PDF

76.3 KB Created: 2021-05-07 13:19:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c5a6740c13c92fcdd61f2d2f6ab402e6 SHA-1: 777097800f8b3ea4f6d2c8426f840801f496fe36 SHA-256: 478a94e1da81b85452a12ddda43221c33853907b38dfe0ca3c4c1daa01ad3e2b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains numerous external links, suggesting a link farm or redirection mechanism to host malicious content. The document body, though heavily corrupted, appears to be a lure related to HP Pavilion dv6 drivers, aiming to trick users into clicking on the embedded malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=hp+pavilion+dv6+bluetooth+driver+windows+7+32+bit
    • https://cdn.sqhk.co/nujidegowupi/GjhHigh/edge_light_shift_lighting_technology.pdf
    • http://wasegulom.mygamesonline.org/godewimoxagezaxesiradojev.pdf
    • https://cdn.sqhk.co/zaviresodew/uKiil36/tropico_6_ps4_review.pdf
    • https://cdn.sqhk.co/razotefo/FibJSPr/83151710179.pdf
    • https://cdn.sqhk.co/jalafimimodo/jhhcgju/galaxy_shooter_strike_force_mod_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4449788/normal_604dda584206d.pdf
    • https://static.s123-cdn-static.com/uploads/4448976/normal_5fc6f3a297476.pdf
    • https://cdn.sqhk.co/ruvajuvewuj/ihgfHgk/zojilofufifen.pdf
    • http://sijemogezabusa.sportsontheweb.net/lazarillo_de_tormes_completo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bcb48613-101a-42a1-a3b7-1a4927c14bbe/80108780811.pdf
    • https://189c2d36-84ff-4b81-9465-96c33c1d3b91.filesusr.com/ugd/35ddae_fccb2a3d96934fba81fb72c85730c66e.pdf?index=true
    • http://kidomaz.epizy.com/alagappan_manual_of_practical_medicine_6th_edition_free_download.pdf
    • https://a2214900-82f6-4ed5-a432-d5ffd14110fa.filesusr.com/ugd/306b6b_1c0158c40bff4431925a6f3b0d3e1477.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d7e0682e-5057-48be-bb3d-e80f414cefe1/pharmacotherapy_a_pathophysiologic_approach_9th_edition_free_download.pdf
    • https://uploads.strikinglycdn.com/files/fbf01e27-b885-4672-a9c8-667327972490/research_proposal_samples_in_education.pdf
    • https://uploads.strikinglycdn.com/files/9a007f7e-65f7-452d-9bb1-e8d7f2abcbd7/1120909595.pdf
    • http://tufuripisaren.epizy.com/centimeters_meters_kilometers_worksheet.pdf
    • http://mikijelirisu.epizy.com/structured_design_methodology_in_software_engineering.pdf
    • https://uploads.strikinglycdn.com/files/99e621a5-7b3d-4137-a223-3f4e5788d40f/sabivijewoge.pdf
    • https://f33d1b56-f518-462b-b61f-c1b5c1ba661c.filesusr.com/ugd/1c44ce_c816f28b4ed44d9796f81b610396abb7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb4e.bin
eb9299482da77371f751491f06fda16472275efc856c48f32db5476bd6cf7100		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB4E 5832 bytes
font_01_sfnt_off0000ff2f.bin
81b5fb94534a354f05683b42b63196e0fb10cce65c8222a0d5b9445388bd299c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF2F 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.