Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a73ffa54f60b628…

MALICIOUS

PDF

80.6 KB Created: 2021-03-30 04:50:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c838dda483c7638265843a53f215f6a SHA-1: d2275cad0d7e2e8c3b70bedb866cb6c2469c978b SHA-256: 5a73ffa54f60b628f2648b71264a74442049ad6ec799e2ca9fd8635f4196b313
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a technique often used for SEO manipulation or phishing, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, specifically identified as a phishing trojan. While no scripts were explicitly extracted, the presence of embedded URLs and the overall structure point towards a malicious document designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=scientific+notation+word+problems+8th+grade+worksheet
    • https://cdn.sqhk.co/selodiro/jeYA1ia/abdomen_anatomy_mcqs.pdf
    • https://cdn.sqhk.co/wisewuguv/CjiOifd/nintendo_switch_online_app_voice_chat_not_working.pdf
    • http://avto-trokot.xyz/5_day_bodybuilding_workout_planhcglo.pdf
    • https://cdn.sqhk.co/vapiwibisa/BEliijf/wetiribujogufozikavow.pdf
    • http://supportcopyright.net/94092672975d686c.pdf
    • https://cdn.sqhk.co/limizolaxa/hhsXheL/varirizajisepowu.pdf
    • http://mainsale.info/encyclopedia_of_computer_science_microsoft_office_mcqsfq9zn.pdf
    • http://trickyturkey.com/pc_games_offline_free_download_for_windows_10ywxv2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://dacf5b84-f80e-4bd8-bb7f-22aad20a1cd8.filesusr.com/ugd/285be4_c6a8af6896fd4647a212f2acd1addaca.pdf?index=true
    • https://790985df-dfec-4a08-b509-00f37668cf87.filesusr.com/ugd/a421e3_b795bf64cedf4f90b721ed742b469173.pdf?index=true
    • http://sarupisegov.rf.gd/brussels_attractions_map.pdf
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_6329a88100734bfdb4989df696a3228f.pdf?index=true
    • https://f59c0a4d-c104-43ac-8966-a5978cdf1b8c.filesusr.com/ugd/0c1ebd_16d1a236c3774c889f011149e9c666be.pdf?index=true
    • https://s3.amazonaws.com/litunux/65062002516.pdf
    • https://s3.amazonaws.com/forupokisip/anemia_ferropenica_que_es.pdf
    • https://8b7199fc-a029-4910-8138-caee300d1cbd.filesusr.com/ugd/da8f68_e3d951c1bf7443b1bd1bb0937e1b3eed.pdf?index=true
    • https://8f1ef4f7-3f23-41ef-a3d6-4e5873a175a2.filesusr.com/ugd/d318ce_bbfcfcb0942e4697bc632db8d3551f3b.pdf?index=true
    • https://4541bc1c-e35c-4de3-bb44-1f53c3e1a56d.filesusr.com/ugd/68f66e_c0e543829f5e4b56afe241ae2b48489b.pdf?index=true
    • https://s3.amazonaws.com/gekojulog/rancilio_silvia_e_v6_review.pdf
    • https://6448a590-b571-4b71-a9e4-820b8531b153.filesusr.com/ugd/782be2_a0d161d4deb34a77b4684c523bd16f44.pdf?index=true
    • https://1ee34b3e-bfcb-4e25-b227-79ffd44eef10.filesusr.com/ugd/9d5096_87fb7041520f4ac18af69c90e9e3996c.pdf?index=true
    • http://rozopujonabesix.epizy.com/beautiful_alpana_image.pdf
    • https://7a3463bf-3117-47cc-940f-ad9d50d05675.filesusr.com/ugd/9f2514_d8fa34df10bb4571a7eb9d6c0f54ebe8.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7a1.bin
0619f8d3fde5f3af29b5aa00907efb0c445ab2a447cc4ab05de2f488b1e0ae61		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7A1 6160 bytes
font_01_sfnt_off00010c7a.bin
a4cf4a1eef11113a0926fcd75a73c799b0c6e7e7936544523627c4dec5042d45		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C7A 11836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.