Malicious PDF — malware analysis report

Static analysis result for SHA-256 4900d873d5d4e0bb…

MALICIOUS

PDF

103.1 KB Created: 2021-03-14 04:44:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 00404ab40e80c230f497a8c40e0ffc65 SHA-1: b1bf6348b3d532d73d6e6f5e2626abc66b53d315 SHA-256: 4900d873d5d4e0bbb426d5f15f9be4dd0dc96f1083bbb5161c0316a5ce37da82
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a large number of embedded links, with several pointing to known malicious redirector infrastructure. The ML classifier and ClamAV detection strongly indicate malicious intent. The primary function appears to be directing users to external sites, likely for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=ibps+clerk+recruitment+2020+pdf
    • https://nategenuniko.weebly.com/uploads/1/3/4/7/134749174/semodajolejobepove.pdf
    • https://cdn.sqhk.co/setawigiz/jhiaVja/gardenscapes_swamp_adventure.pdf
    • https://cdn-cms.f-static.net/uploads/4413719/normal_604b7ebd94908.pdf
    • https://cdn.sqhk.co/vuzujugasije/nib9yjd/dorezetuv.pdf
    • https://cdn.sqhk.co/rapawaferew/jhhhehh/archery_master_3d_hack_mod_apk_free_download.pdf
    • https://cdn.sqhk.co/pulijidapis/eUNggKY/8577007352.pdf
    • https://cdn.sqhk.co/lewivapawo/kgghhea/luvirarugex.pdf
    • https://cdn.sqhk.co/nobixapo/jczKhjZ/doom_dawn_survival_war_2.pdf
    • https://cdn.sqhk.co/fosojatesog/LVRAVig/zuvasoduduwenefobelar.pdf
    • https://cdn.sqhk.co/jisaside/iqZFhcJ/17099489748.pdf
    • https://cdn.sqhk.co/wubumeze/gjShjhe/40617809413.pdf
    • https://cdn.sqhk.co/zezetemirag/fIlQgf8/poxofado.pdf
    • https://static.s123-cdn-static.com/uploads/4447646/normal_5ff1d913bc3d7.pdf
    • https://cdn.sqhk.co/tikalijit/9Yd4vhg/ios_keyboard_with_ctrl_key.pdf
    • https://nozuresosobud.weebly.com/uploads/1/3/4/7/134758814/232e852ffcf666.pdf
    • https://repawuwo.weebly.com/uploads/1/3/5/3/135313919/fitijepitoxisu.pdf
    • https://static.s123-cdn-static.com/uploads/4453579/normal_5fc62d7e43859.pdf
    • https://cdn.sqhk.co/vekosozob/jSibqhj/jekotavijuto.pdf
    • https://cdn-cms.f-static.net/uploads/4453108/normal_601f1963120ff.pdf
    • https://cdn.sqhk.co/gotubosif/glKjaLg/79897118201.pdf
    • https://static.s123-cdn-static.com/uploads/4420610/normal_5fff5bbfa6301.pdf
    • https://lodobapidadisu.weebly.com/uploads/1/3/1/1/131164557/eac752096a651f0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://2a009ac4-5770-49f2-ae16-4ce107243443.filesusr.com/ugd/59deca_c4e9dd16f2f74552bdf29294630366b9.pdf?index=true
    • https://288c7b4b-0494-48f6-8ee2-9dd519b96b0a.filesusr.com/ugd/a107db_d9595bd4716749398d40aa523f485ad1.pdf?index=true
    • https://e6676b24-921d-4f57-8fca-beda98688f3c.filesusr.com/ugd/144d27_9005f74085ae4343b699ac14b4b6307d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010caa.bin
ce8d347fb36b4c53ce18ec5204dbfd859b6c245d73b3815362032a07a574fd72		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CAA 5280 bytes
font_01_sfnt_off00011e78.bin
c84fa97580be3bb0d7abe709b2357faf60f0fcc4bf611cee4d42f281fb2cfb4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E78 19352 bytes
font_02_sfnt_off00015603.bin
3f74404662a145fd35b6f49bd9d9a6f14f7a8129a1837d1537b41952af9fe844		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15603 11672 bytes
font_03_sfnt_off00017de7.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17DE7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.