Malicious PDF — malware analysis report

Static analysis result for SHA-256 5387cc36a86155cb…

MALICIOUS

PDF

66.8 KB Created: 2020-12-05 10:47:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: a8973eadd6e9fb3066cdec52c315f9bd SHA-1: 555f04dbf499f04a49aeff6e0a1cd4ffe9355a77 SHA-256: 5387cc36a86155cb5bbbb6fb151ab9b36f33eee6a9b3cfc8bf810b828e1e1fae
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple invisible links, with one specifically luring users to a CAPTCHA-themed page. This suggests a phishing or SEO spam campaign. The ClamAV detection and ML classifier further support its malicious nature. No scripts were extracted, but the embedded URLs are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
    PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=captcha+plugin+for+contact+form+7 In PDF document text
    • https://fawurefo.weebly.com/uploads/1/3/4/4/134441885/7424309.pdfIn PDF document text
    • https://vexuneka.weebly.com/uploads/1/3/4/5/134584550/nemogoje_sufekezasurogip_suwaferod_jumokuw.pdfIn PDF document text
    • https://zikegebuner.weebly.com/uploads/1/3/4/8/134856814/dalenamimexizekom.pdfIn PDF document text
    • https://tigibivimibi.weebly.com/uploads/1/3/4/3/134344299/fewevowe.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nitizobuv/11400273723.pdfIn PDF document text
    • https://s3.amazonaws.com/potamotaz/kelidukifuvemi.pdfIn PDF document text
    • https://s3.amazonaws.com/debamijizozexo/65240847083.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0dda31452f90b7fe53205/t/5fc5d83a61e25426e10290be/1606801470243/dedotigelawo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1a765405d5340f32ee4e2/t/5fc422654f9837572061c7fc/1606689382287/zodipeginik.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd405bb594f4357995912e/1606238299461/21916215691.pdfIn PDF document text
    • https://s3.amazonaws.com/lomogas/sufixutasavexoba.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e8e5bf71053ccb103ceb/t/5fc6a8bb9b1ed03538c96c68/1606854844168/gipaxubixogo.pdfIn PDF document text
    • https://s3.amazonaws.com/lorugipopuxe/create_calendar_template_in_outlook_2013.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c813.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC813 5236 bytes
SHA-256: 45a97885b249b6b7191d59f7f7bfad3b80e0cef8d7d7ea0f0cadd3ec3db96d14
font_01_sfnt_off0000d9c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9C3 10756 bytes
SHA-256: 15bb5d4e8495d7af9a7326b985ca39741ae2f3fb6b6c579d9bd2c48aba1804e2

Open this report in the interactive analyzer, or submit your own file for analysis.