Malicious PDF — malware analysis report

Static analysis result for SHA-256 5314c1a13cbea618…

MALICIOUS

PDF

73.1 KB Created: 2021-02-25 18:52:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 680a13969a9e6f8d6fa0fda65855a2cf SHA-1: 91a0245b31477694ed46ea20f390a31b6691919c SHA-256: 5314c1a13cbea6184e153dd43db475d47962d578156c27e0308672f140a76fc8
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=invacare+perfecto2+5-liter+oxygen+concentrator+manual PDF link annotation
    • http://xijulefabogi.getenjoyment.net/pawnee_native_american_tribe_clothing.pdfIn PDF document text
    • http://everydayy.fun/ultimate_car_driving_simulator_apk_mod_hackb6xdr.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424662/normal_600a654373cd0.pdfIn PDF document text
    • http://fapegag.22web.org/sojabiresugemi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4473640/normal_5fecadc39db72.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393220/normal_600a819844df7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446937/normal_5ff84a8be739e.pdfIn PDF document text
    • http://covid-19online.site/araby_by_james_joyce_plotcyy22.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447630/normal_601691e55fa83.pdfIn PDF document text
    • http://famozosivupiwij.sportsontheweb.net/rurenomokukavaxokel.pdfIn PDF document text
    • http://paxezot.getenjoyment.net/bella_vita_salon__day_spa_leavenworth_ks.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422912/normal_601780ec84a15.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417422/normal_602f19038d124.pdfIn PDF document text
    • http://komarovskii.xyz/firuravoziduvesifebuf0oon9.pdfIn PDF document text
    • http://romeoplanet.club/will_a_universal_remote_work_on_a_toshiba_tvcf67y.pdfIn PDF document text
    • http://famozosivupiwij.sportsontheweb.net/14.3_water_pollution_answer_key.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gulapore/pesticides_and_bioaccumulation_worksheet.pdfIn PDF document text
    • http://muvubavove.epizy.com/puboveker.pdfIn PDF document text
    • https://s3.amazonaws.com/bokelur/gapowevibegefesibovinetof.pdfIn PDF document text
    • https://s3.amazonaws.com/getizar/memaruduzimowoz.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE36 5612 bytes
SHA-256: 82c11afb519d63626ce32587ebdcf6dbc57e75b86460c6d382b4013ecab43233
font_01_sfnt_off0000f166.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF166 10832 bytes
SHA-256: cdc6298ccc91ead58e5be08c6d01ed408d19900916327c542b08d67758b4783e

Open this report in the interactive analyzer, or submit your own file for analysis.