Malicious PDF — malware analysis report

Static analysis result for SHA-256 56db7fc6af461108…

MALICIOUS

PDF

111.8 KB Created: 2021-06-10 09:21:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 22c27d71b54725c7a7150aa3cb6844b0 SHA-1: 004b52ca1eae31ea1ac77ef10756b86d7484c453 SHA-256: 56db7fc6af461108ed4d6b285a6b14d42f0a4629917d25e553ba311f59553cb8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or trojan delivery. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious sites, potentially for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8465

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/pbw?utm_term=happy+birthday+priya+status
    • https://pakujefaf.weebly.com/uploads/1/3/0/7/130740244/2b1c27ec95c5fd.pdf
    • https://loputoporebile.weebly.com/uploads/1/3/4/8/134847610/zutirepumano.pdf
    • https://xakalawuvobovu.weebly.com/uploads/1/3/1/0/131071286/a3181cf81a7ac.pdf
    • https://dumasibomis.weebly.com/uploads/1/3/4/6/134642495/xikaji_nixegajovuvov_zumusuzarenu_donufogugux.pdf
    • https://cdn-cms.f-static.net/uploads/4391611/normal_6035119d019e8.pdf
    • https://cdn-cms.f-static.net/uploads/4405413/normal_60614af256f2e.pdf
    • https://zikepasut.weebly.com/uploads/1/3/4/1/134108801/zetaxolejonaxen.pdf
    • https://fumevido.weebly.com/uploads/1/3/0/8/130874276/3f903d.pdf
    • https://digulowewuw.weebly.com/uploads/1/3/4/3/134363346/supuwedovamuk_korot_jogigufef.pdf
    • https://gupinemarumilaw.weebly.com/uploads/1/3/4/0/134040787/1410841.pdf
    • https://xixozikitep.weebly.com/uploads/1/3/4/0/134097223/kedonigezamut_vazekabuzila_bolut.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d0041763-b769-4d02-b880-90e6300be5ff/casio_lk-175_ppk_61-key.pdf
    • https://uploads.strikinglycdn.com/files/0f6b11cd-1ba0-423f-99ab-546f1b4f619a/jaxirimopuzab.pdf
    • https://uploads.strikinglycdn.com/files/bf64e779-114b-4162-bf24-4995b05d8d3c/32055421875.pdf
    • https://uploads.strikinglycdn.com/files/58e8e056-9766-41fe-a8f8-16f9ec0d8357/59667842646.pdf
    • https://uploads.strikinglycdn.com/files/c7be84db-da3d-4dfc-ab15-e3a9b14332d1/physics_for_scientists_and_engineers_randall_knight.pdf
    • https://uploads.strikinglycdn.com/files/e68d65a0-67da-43c3-b08c-ed9c4ed85322/megudutuxopufewebot.pdf
    • https://uploads.strikinglycdn.com/files/fd6aa2d7-3f88-4209-a714-f0c01477e042/graco_ready_to_grow_double_stroller_chicco_car_seat.pdf
    • https://uploads.strikinglycdn.com/files/45de0879-6249-418c-9cd9-04f5fb5abd38/vokukobojokedewu.pdf
    • https://uploads.strikinglycdn.com/files/e1873e7d-30a2-4b2d-a57e-4d6a55d48800/mifutosa.pdf
    • https://uploads.strikinglycdn.com/files/a96649aa-17c4-48cd-b33c-b5f234b1e827/97418533162.pdf
    • https://uploads.strikinglycdn.com/files/93c29f43-828f-4808-aa39-459922fe6148/battle_chasers_nightwar_extras_code_android.pdf
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000145c5.bin
fb5f306357f29934340ea5cc7df47134fbd473022bea976958c4f098cc1c34f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145C5 5220 bytes
font_01_sfnt_off00015772.bin
d5ecec3e822993868ba70e247019bcdb656a9fee58d620eb93bc70658e929280		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15772 3720 bytes
font_02_sfnt_off000162ce.bin
ec1fb73bd6cafb4cd9926e409620d56fd8e74e61d908500fac8eea02a9b78d9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x162CE 20580 bytes
font_03_sfnt_off0001a0ff.bin
53ae19a71bdd7925ff16196665ae0bb2b08c0aa4314f7006bfe9ead1cac2b2ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A0FF 10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.