Malicious PDF — malware analysis report

Static analysis result for SHA-256 47cdd5421eacd5ef…

MALICIOUS

PDF

70.2 KB Created: 2021-03-12 07:29:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c67043abf8cef2177dcb1cc2ea9f94d0 SHA-1: 7f9363bcf3180c51f3880e9927c6e1fab4538db4 SHA-256: 47cdd5421eacd5ef8c7da4909d45f92f826812b5e9e799c2d03158ff59edb12c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. The heuristic analysis revealed a significant number of external links, suggesting a link farm or redirection scheme designed to lead users to malicious sites. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a date, but no clear textual lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=conqueror%2527+s+blade+gear+guide
    • https://nupigefaxobabu.weebly.com/uploads/1/3/1/0/131070289/dopaminazizev.pdf
    • https://niravewowinud.weebly.com/uploads/1/3/5/3/135343761/9144517.pdf
    • http://fodepurarag.22web.org/what_is_the_stock_symbol_for_the_e_mini_sp_500.pdf
    • http://zozuwax.66ghz.com/zegamonudotokivajev.pdf
    • http://rorezorejadij.iblogger.org/online_personal_accounting_software_free.pdf
    • https://koponabunabo.weebly.com/uploads/1/3/4/5/134520941/seromuvasateguf.pdf
    • https://ditoleruv.weebly.com/uploads/1/3/5/3/135345680/9218820.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/ce251a06-26ca-4ef0-b486-1b0dc7d176ab/what_are_data_collection_instruments_in_research.pdf
    • https://s3.amazonaws.com/muwemivumazulax/chuyn_t_nh_sang_word.pdf
    • https://uploads.strikinglycdn.com/files/f6cda0e6-1af0-4f53-84f6-d1b37bea78de/how_to_wear_baby_bjorn_carrier_front_facing.pdf
    • http://galiwasik.rf.gd/15694423324.pdf
    • https://s3.amazonaws.com/kelukakeb/lumug.pdf
    • https://uploads.strikinglycdn.com/files/e528c4d6-b8e4-42da-a1c4-b3199b417183/viper_3305v_valet_mode.pdf
    • https://uploads.strikinglycdn.com/files/a7015dc9-72cb-44c0-b9b5-69c7efee0ba9/kudorofoniwuroxosabanezeb.pdf
    • https://s3.amazonaws.com/kevava/29649957478.pdf
    • https://s3.amazonaws.com/napejaxosinages/bhojpuri_chhath_geet_hd_video.pdf
    • https://uploads.strikinglycdn.com/files/3ef4e46f-6e4e-450f-9473-c7f58b8a44cf/pifavu.pdf
    • https://s3.amazonaws.com/vuxirefare/52610045080.pdf
    • https://uploads.strikinglycdn.com/files/fedcedfe-b60c-4692-ba3d-b81e6e0d2d94/samsung_grand_prime_pro_panel_price_in_pakistan.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c9c6.bin
d9fe5e13d840541ffacb734b4ed68fe011f0f3ece8354e71cccd46da8921bbb7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9C6 5116 bytes
font_01_sfnt_off0000db26.bin
2fd2c9c74edaa91ef5e61c45a6e2c0774045e132feab12323ee0698ae3f52dba		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB26 10372 bytes
font_02_sfnt_off0000fdc7.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDC7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.