Malicious PDF — malware analysis report

Static analysis result for SHA-256 5457cf1221ea0d3a…

MALICIOUS

PDF

78.5 KB Created: 2021-03-16 05:39:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f38099ec259db9b80e41ddf6ad6f5f0c SHA-1: ebc3b7e69de1edf2bed13e6168ce6e8588c59f7d SHA-256: 5457cf1221ea0d3a9c3376cd3b4c2d7fc72f309c86cac299b29d22fe0e9106fc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which point to suspicious domains and are likely part of a link farm designed to distribute malware. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically a phishing or trojan distribution campaign. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9953

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=weather+report+of+delhi+today
    • http://zespodsvetkoy.site/wallpaper_hd_for_mobile_carwph9o.pdf
    • http://academic-club.ru/4532690388347wxl.pdf
    • http://setokanekema.mygamesonline.org/tuvemibuwajagoburopok.pdf
    • http://dokojekiferej.mygamesonline.org/88875750673.pdf
    • http://beamorem.com/muvunesikw8xvv.pdf
    • http://rumurel.mywebcommunity.org/paneroworunopo.pdf
    • https://domazatavaxagit.weebly.com/uploads/1/3/0/7/130775902/lukajutesud.pdf
    • https://danegatazi.weebly.com/uploads/1/3/0/7/130776269/napof.pdf
    • https://jarajegixam.weebly.com/uploads/1/3/1/4/131437089/ritolekodabutes.pdf
    • http://pasadurasasagi.medianewsonline.com/21919072734.pdf
    • https://wisamifogafize.weebly.com/uploads/1/3/4/5/134598642/zagulazovitu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/776cdc64-4235-4d87-9937-1faef3eacc63/how_to_pair_skullcandy_sesh.pdf
    • https://9fbeb193-358d-48fe-b9d9-45f8b63f6b3c.filesusr.com/ugd/ab67b9_d1e2672254314b95a4dac7e44af35dac.pdf?index=true
    • https://uploads.strikinglycdn.com/files/dd431fbd-3e68-4802-a687-1b925baef17b/identificacin_de_razones_trigonomtricas_seno_coseno_tangente_en_tringulos_rectngulos.pdf
    • https://uploads.strikinglycdn.com/files/db90cfc8-b142-48db-b334-cd5200215814/lydia_davis_break_it_down.pdf
    • https://409b2d23-5c1d-402e-97df-26c0da9299b0.filesusr.com/ugd/2e3d42_501262cb4d83419abb4d7aa01b75a689.pdf?index=true
    • https://uploads.strikinglycdn.com/files/19476a5b-b42f-43ff-9887-a5b8832f4c89/multivariate_analysis_python.pdf
    • https://dec4a425-646e-450a-80ca-a73a75d058ad.filesusr.com/ugd/ba3095_e232b675a0294866966cabef726f3ceb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/487aaf87-c92d-45b7-8e1d-65ac70ffa416/parkour_race_free_online.pdf
    • https://4779f2f8-a33e-4327-9c78-21ee0bcf4620.filesusr.com/ugd/31bf02_fd78a1a273c2472fa41996967279d2ee.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7e711970-327b-402e-8f2d-a8acd39151d0/grammar_quiz_grade_6.pdf
    • https://uploads.strikinglycdn.com/files/595a1a32-3169-4074-b512-5620f0d84955/boy_in_striped_pajamas_final_scene.pdf
    • https://uploads.strikinglycdn.com/files/8ce9694e-1fc8-450e-b1a0-f1f7298162bd/gokovemogo.pdf
    • http://duxegejuw.atwebpages.com/final_fantasy_x-2_walkthrough_ps2.pdf
    • https://57eba762-b826-4879-8d7a-7f480aba2934.filesusr.com/ugd/e89c2b_9283e0111d994bf7b926ab761bf74c4a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f08bbca7-63ff-44f8-9fa2-03dbc75d74df/4914304110.pdf
    • https://uploads.strikinglycdn.com/files/5491169e-2628-4001-b017-70b989675588/samsung_tu8200_58_inch_review.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e93d.bin
93db9445e3bec157519330da700eef78ce7f4082698232f2c0b6eea5e1630bcb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE93D 4748 bytes
font_01_sfnt_off0000f98a.bin
584a3438950af960cda5a542779bb615b935bd0251cc1562011e61a53e9b0863		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF98A 10996 bytes
font_02_sfnt_off00011e1d.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E1D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.