Malicious PDF — malware analysis report

Static analysis result for SHA-256 586a255f736483a8…

MALICIOUS

PDF

72.7 KB Created: 2021-01-18 17:14:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 70a7a2d61050552ef5494fb0cfd3c990 SHA-1: 76342507199b97fe94a9a9a73188e9fe26edd50f SHA-256: 586a255f736483a89568deee77a5536b1f51ef8c099e650149555d8ff8c9c8bf
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs and is flagged as a link farm on disposable hosting, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. The document body, though heavily obfuscated, contains references to 'Amaravathi song telugu' and 'wkhtmltopdf', suggesting a lure to disguise malicious links as search results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7403

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=amaravathi+song++telugu PDF link annotation
    • https://site-1176700.mozfiles.com/files/1176700/kafepabujofawuk.pdfIn PDF document text
    • https://site-1175818.mozfiles.com/files/1175818/sakupokatuzaxupifiwof.pdfIn PDF document text
    • https://site-1191940.mozfiles.com/files/1191940/vonoxiza.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4427529/normal_5fcd07de2ef64.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450242/normal_5fbbcd4eee943.pdfIn PDF document text
    • http://dixajadabaw.66ghz.com/16834823464.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460946/normal_5fdf4a3ae28f9.pdfIn PDF document text
    • https://site-1179767.mozfiles.com/files/1179767/60571341598.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381344/normal_5fc60176cac7a.pdfIn PDF document text
    • https://dosisusibifoba.weebly.com/uploads/1/3/4/2/134236234/pigevolev.pdfIn PDF document text
    • https://ridimejaxokixis.weebly.com/uploads/1/3/5/3/135340331/3400394.pdfIn PDF document text
    • https://site-1217744.mozfiles.com/files/1217744/windows_movie_maker_alternative.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377128/normal_5fbd72af1df79.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mavixu/chitta_jaggi_sidhu_song_djjohal.pdfIn PDF document text
    • http://panejolaraluka.rf.gd/angry_birds_star_wars_hd_apk_mod.pdfIn PDF document text
    • https://s3.amazonaws.com/dadupawo/pocket_atlas_of_sectional_anatomy_thieme.pdfIn PDF document text
    • http://vuropomap.epizy.com/transactions_essential_english_language_skills_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xokebore/bigowolegezu.pdfIn PDF document text
    • http://roxigivakupumun.epizy.com/85085524153.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e87f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE87F 5148 bytes
SHA-256: 67f285a01ef3175e1744c0cbdb18f297e910a66b0aa4c04d3db1fd92179f4a8f
font_01_sfnt_off0000f9d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9D6 11072 bytes
SHA-256: fadc044487357f108ca9c91b26177b492e71aace9c2acf8d48d9c08d156b35b1

Open this report in the interactive analyzer, or submit your own file for analysis.