Malicious PDF — malware analysis report

Static analysis result for SHA-256 546e5f121c8bc269…

MALICIOUS

PDF

88.1 KB Created: 2021-03-10 06:14:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cfeebc403c9b728d24dd807b7ab41c48 SHA-1: 54d23744c9b385754b4214bc1aea503c2d9851db SHA-256: 546e5f121c8bc269b18cc59652f02d508d10386e7fac5bc2b9cbdba98462c15b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the presence of numerous external URLs points towards a likely attempt to redirect the user to malicious or deceptive content, potentially for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=geeksforgeeks+python+pdf
    • https://cdn-cms.f-static.net/uploads/4390068/normal_5fd761cd6b5c2.pdf
    • https://lelewamopubexab.weebly.com/uploads/1/3/4/3/134324934/xugaje.pdf
    • https://cdn-cms.f-static.net/uploads/4444852/normal_601a2a5ec770a.pdf
    • https://cdn.sqhk.co/bilanogakiw/jeyjfhh/big_bang_theory_cast_ages.pdf
    • https://cdn.sqhk.co/vumivatuvi/d8eih4L/redawutajijevisutamagurim.pdf
    • https://nidozasa.weebly.com/uploads/1/3/4/6/134680612/fesoniluliwaba-sitabamisaxi-tulubipi.pdf
    • https://rufajesovulibo.weebly.com/uploads/1/3/4/2/134235528/2592168.pdf
    • http://prizinsta24.online/why_is_the_windstorm_significant_inmn631.pdf
    • https://cdn.sqhk.co/feguzuvubut/jeaihqV/suwonukezozo.pdf
    • https://cdn.sqhk.co/ziriziwebu/gijbicV/hearts_ladies_fc_twitter.pdf
    • https://sinosopad.weebly.com/uploads/1/3/4/8/134892142/586225.pdf
    • https://cdn.sqhk.co/vitikitema/jbYbpxG/gosibe.pdf
    • https://jibigevemur.weebly.com/uploads/1/3/0/8/130873945/besiro_kutiwala.pdf
    • http://poroda.site/timawicutt.pdf
    • https://cdn-cms.f-static.net/uploads/4386622/normal_60414144c5a0c.pdf
    • http://cetapp.xyz/2002_polaris_xplorer_400_4x4_for_sale5bam2.pdf
    • https://cdn-cms.f-static.net/uploads/4467005/normal_6044a04aee213.pdf
    • https://cdn.sqhk.co/wazafanez/SWVbDjc/best_lock_screen_wallpaper_for_iphone_xr.pdf
    • http://lenudes.com/pacific_fire_vine_maplewnjip.pdf
    • https://bagesasadav.weebly.com/uploads/1/3/4/3/134383367/235181.pdf
    • https://vunidiripoga.weebly.com/uploads/1/3/1/4/131453449/kafamowiwogovow.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c49.bin
4e8f51d256c1f1c565f590cd4892c11829376616ccdf6a5ba080139512a4eb37		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C49 5000 bytes
font_01_sfnt_off00011d4f.bin
b70e5a3014f6502c6398d5d3a96250e285d51e26acb0f51dcd6c3882dfce7622		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D4F 11840 bytes
font_02_sfnt_off00014549.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14549 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.