Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b343ee329bc2a09…

MALICIOUS

PDF

72.2 KB Created: 2020-12-14 05:14:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 039b98c2033d140796ee050f96f9fff7 SHA-1: 7df5a052f4b947dd2355a12677539784a141981f SHA-256: 4b343ee329bc2a09fb8a4bbbc614c5b43f484b679e1601e2f02c9759af2ac703
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many hosted on Weebly, suggesting a link farm or redirection scheme. The 'SE_INVOICE_LURE' heuristic indicates a deceptive document body, and the 'PDF_SEO_LINK_FARM' heuristic confirms a large number of external links. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to direct users to phishing or malware-hosting sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=sql+export+to+excel+spreadsheet+is+full PDF link annotation
    • https://fidimamafiw.weebly.com/uploads/1/3/4/6/134624465/4209910.pdfIn PDF document text
    • https://tamipabofoj.weebly.com/uploads/1/3/4/8/134876193/kirotuzadu.pdfIn PDF document text
    • https://gixoxiri.weebly.com/uploads/1/3/4/7/134707295/dixuxamejoxel.pdfIn PDF document text
    • https://semopadilined.weebly.com/uploads/1/3/4/6/134696525/a31a3ba62.pdfIn PDF document text
    • https://xinibazekude.weebly.com/uploads/1/3/4/6/134666807/jugifubonolu.pdfIn PDF document text
    • https://povutepumik.weebly.com/uploads/1/3/2/7/132741486/3719004.pdfIn PDF document text
    • https://kupajozowujuz.weebly.com/uploads/1/3/4/8/134881722/7394328.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc597e6e9fc3622d541d4ab/t/5fd66ee5034a586a4f45bca3/1607888614407/possessive_pronouns_grade_1_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/club_penguin_mission_9_guide.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2b03bbd14ff0dd2a824dd/t/5fc5eabe5147b14804feef13/1606806210948/jaxib.pdfIn PDF document text
    • https://s3.amazonaws.com/tulosa/milakirujixofi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96591017-b0ea-47ff-b585-3e91d2713903/modele_de_cv_en_arabe.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5156917e7202640050e05/t/5fc5bd33e18c5c478ec2114b/1606794550133/14641589486.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dbad23ee-52eb-495c-8a73-679ce02ff2dc/sacroiliitis_exercises_mayo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc7925ca4492a057e243d95/t/5fd694f8df2f0204c23eef10/1607898360427/battery_capacity_voltage_meter_manual.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2fe30abaecd33182fe85c/t/5fca489a9bc93d20d9baf4d8/1607092379177/goxowolabalajakit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d242.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD242 3168 bytes
SHA-256: d8d0c1c12fce81e7a0e500839a2c899084eee10276cb1d968f03a6f8f5e513f6
font_01_sfnt_off0000dd91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD91 5540 bytes
SHA-256: 4cd64e13670783e7577add6f6816c04ccec7ff449e7a36804ee660ef5ac942d9
font_02_sfnt_off0000f06b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF06B 10208 bytes
SHA-256: ff470c6853d376e4358d90eb7a2222258b21514e0706c17680df849c6a06d5d8

Open this report in the interactive analyzer, or submit your own file for analysis.