Malicious PDF — malware analysis report

Static analysis result for SHA-256 51584956ba211988…

MALICIOUS

PDF

69.5 KB Created: 2021-03-17 05:33:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 36e2bec5f8810f5c951317729a94434a SHA-1: 2bb2ac28786caa03c478a9261fb7be8f5bf9c382 SHA-256: 51584956ba211988befeda32e26036a5c190d82386f5b3ebeb518e7261fa3a06
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are to suspicious domains, indicating a link farm or phishing lure. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and numerous external URIs point towards a phishing or malware distribution campaign, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9972

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFException. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=scanshell+800nr+calibration+sheet+pdf
    • https://cdn.sqhk.co/ponesigis/Uxhc6ia/free_live_tv_apps_uk.pdf
    • http://bcpzonasegura10beta-viabcp.com/88691510041mrd8l.pdf
    • https://cdn.sqhk.co/meduxemij/hegd9jd/54737099630.pdf
    • http://goodshopsales.xyz/what_happened_in_the_exploration_and_colonization_eraosq96.pdf
    • http://tells.fun/somagonerbncps.pdf
    • https://cdn.sqhk.co/vekokizijam/jigdqs3/melijubipupewetitowurefev.pdf
    • https://cdn.sqhk.co/zixapegof/hg2p3rj/world_soccer_challenge_mod_apk_unlimited.pdf
    • https://cdn.sqhk.co/zobelekivix/jjQhihe/xeroluxutozafadiri.pdf
    • https://cdn.sqhk.co/tumowara/HigggZV/best_free_offline_navigation_app_for_iphone_europe.pdf
    • https://cdn.sqhk.co/jovakuki/hhyjbid/xuzevapivejo.pdf
    • https://cdn.sqhk.co/begokaxawip/1gfiiRG/street_fighting_3_king_fighters_mod.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://50b7e5d6-ab0e-41ff-bbcb-47d024e5c277.filesusr.com/ugd/45d8ab_728b79f13f05410cb598d7b64835457b.pdf?index=true
    • https://0a01f052-6ee6-4bfa-868d-d2e49373b03f.filesusr.com/ugd/55f640_88b1e2e069a949ada11f710ac68a9c78.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3a9aa484-c33c-423f-8a9b-f037b4e7e809/fios_router_g3100_specs.pdf
    • https://uploads.strikinglycdn.com/files/24444367-5c19-4171-9e49-2775092f2102/how_to_fix_graco_simple_sway_swing.pdf
    • https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_5226d9a9d08740de89d2db1e1fc425b3.pdf?index=true
    • https://s3.amazonaws.com/vobuturinivi/calm_relaxing_music.pdf
    • https://s3.amazonaws.com/wurivuve/lg_440g_phone_manual.pdf
    • https://s3.amazonaws.com/wuniku/photoshop_cs6_for_laptop_windows_10.pdf
    • https://s3.amazonaws.com/rutufokedizon/fomakaloxedesekukog.pdf
    • https://s3.amazonaws.com/zalomi/bufejevepuwemomosega.pdf
    • https://uploads.strikinglycdn.com/files/2e4a7638-a97d-42e5-8782-912893fd8118/what_does_high_transferrin_saturation_mean.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d96c.bin
08b581fefa6dbb6e229dd1bb4ae1317c963df19f8afc667f6b2fe4ebcc5493e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD96C 5824 bytes
font_01_sfnt_off0000ed2a.bin
056f8c3ca8404331fd69023e4b22f32e74de89458f4ba0b175825716c24dc12a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED2A 10912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.