Malicious PDF — malware analysis report

Static analysis result for SHA-256 532893dc86f8da4c…

MALICIOUS

PDF

102.1 KB Created: 2021-04-04 07:21:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d17e77e9cc0f32eebcbce667b5e1626f SHA-1: d48741f35d5f6715e3564f37cf9b7a389bbfed12 SHA-256: 532893dc86f8da4c52c9a41e20df82ee7fddfe8699d3eeac42f27b45c8f4dfab
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a technique often used for SEO link farms or to redirect users to malicious sites. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically phishing. While no scripts were directly extracted, the PDF structure and extensive external linking suggest it's designed to lead the user to a compromised or malicious website, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=sparkle+radwimps+piano+sheet+pdf
    • https://static.s123-cdn-static.com/uploads/4402261/normal_5fc598cbc490e.pdf
    • https://cdn-cms.f-static.net/uploads/4490128/normal_606924e0d061d.pdf
    • https://cdn-cms.f-static.net/uploads/4464702/normal_60550fe4d433d.pdf
    • http://forajetivajuw.iblogger.org/gowezaxeliridetel.pdf
    • https://cdn-cms.f-static.net/uploads/4382618/normal_6026ce4eb037e.pdf
    • https://cdn-cms.f-static.net/uploads/4403565/normal_603ea611441cc.pdf
    • http://tupuwuwegidava.22web.org/xodeleladibapafozatavam.pdf
    • https://cdn.sqhk.co/kuwusemob/kijchgo/visolonos.pdf
    • https://cdn-cms.f-static.net/uploads/4408475/normal_603c2f29ed25f.pdf
    • https://static.s123-cdn-static.com/uploads/4390383/normal_5fc6cf3c1e373.pdf
    • https://cdn-cms.f-static.net/uploads/4490752/normal_60660d59ab9bc.pdf
    • https://cdn.sqhk.co/xezafube/dk5hcny/swiperefreshlayout_background_color.pdf
    • http://vufulilaririvu.iblogger.org/roridemuwigalafe.pdf
    • https://cdn.sqhk.co/zujijivopuju/HhhTHZt/40741341154.pdf
    • https://cdn-cms.f-static.net/uploads/4459318/normal_600d10056a8b0.pdf
    • https://cdn-cms.f-static.net/uploads/4469378/normal_602ac0c5c5574.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://b3a8b944-ddec-4d17-9b53-5a1c05c66d8c.filesusr.com/ugd/314503_7d00da1b9752424d9c1735c7ac40f9f1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/64a1dfd1-b190-4fa9-8997-aa0e6e954fd7/hunter_icc_controller.pdf
    • https://uploads.strikinglycdn.com/files/677e1686-6d8f-4a67-b110-3c51a4d8f17a/dimezoligofasoka.pdf
    • http://refofigeto.epizy.com/what_are_the_basic_tenets_of_taoism.pdf
    • https://uploads.strikinglycdn.com/files/cab4f8ef-854e-47b4-8c31-865b70594ace/football_manager_2016_best_strikers_cheap.pdf
    • https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_3e85539e23004bf887a9ea362040f21f.pdf?index=true
    • https://e791dc30-71fd-4519-a75e-453748eb9c32.filesusr.com/ugd/8a5fcf_d49484ee24324463a559f056df6c463c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off0001657e.bin
19f38a8ab9e55c68e87f1e54a35218866feeb867d26a27b16271da55d2030160		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1657E 10668 bytes
font_00_sfnt_off0000f373.bin
9e165c7eac4dfc0b55229b7f776ba1580b9fc841e97856398bbdc3764ae77b7a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF373 6660 bytes
font_01_sfnt_off000109df.bin
8ba62949e733ff0c7e9c76effd4d1f72135bc7b67cb4d84085fd6a09cce23ac4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109DF 5328 bytes
font_02_sfnt_off00011bd7.bin
05ca557cac35f0617b2fc7685ae103a8cdc577b6ae139e0319db7fc8ae4f4008		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BD7 11132 bytes
font_03_sfnt_off00014206.bin
7e60ef4a37cc1e70568993948478eb09e287de2919d929287100a5a5ef2a093c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14206 16280 bytes
font_04_sfnt_off0001577c.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1577C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.