Malicious PDF — malware analysis report

Static analysis result for SHA-256 5cdc4c21b1b1a680…

MALICIOUS

PDF

80.9 KB Created: 2021-04-08 11:14:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e42dd7c14697169bcb2eb097465415f3 SHA-1: 7958ed3a6f469d97776daeb13ffe3a93d3efa68a SHA-256: 5cdc4c21b1b1a680966a18dbb49c74dff777ec07f8f9d1653d61b961a6622f9f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic flagging it as a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or distributing further malware. While no scripts were directly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=pantone+formula+guide+solid+coated
    • http://vomidujoma.scienceontheweb.net/40195526819.pdf
    • http://xemokajoled.medianewsonline.com/rinerukowuk.pdf
    • http://xitodefigatefuj.medianewsonline.com/arihant_banking_awareness_book.pdf
    • http://folejaf.mypressonline.com/math_worksheets_7th_grade.pdf
    • https://sugowula.weebly.com/uploads/1/3/4/6/134646485/kuzexi.pdf
    • https://vumifedesonuzik.weebly.com/uploads/1/3/4/8/134849268/5b3c11048e5a1fa.pdf
    • http://bexukavinawexov.mygamesonline.org/4th_grade_math_review_packet_common_core.pdf
    • http://joxezorov.mywebcommunity.org/nodidomozovodiboxeja.pdf
    • http://xuribof.medianewsonline.com/how_to_know_if_your_motherboard_is_compatible_with_cpu.pdf
    • https://diwowure.weebly.com/uploads/1/3/4/5/134592565/bawov_zegulifo_xozakigaparij.pdf
    • http://sewatumafuta.medianewsonline.com/xumekirikumunabegiv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sakaburepagase/beginning_spanish_words_worksheet.pdf
    • https://s3.amazonaws.com/pegozegi/45133237965.pdf
    • https://s3.amazonaws.com/taguxif/933799465.pdf
    • https://s3.amazonaws.com/moduxanakuri/9420750489.pdf
    • http://jelenaw.myartsonline.com/80657680804.pdf
    • https://s3.amazonaws.com/goveruduzewoxu/autocad_architecture_2014_crack.pdf
    • http://jujobope.atwebpages.com/gatez.pdf
    • https://s3.amazonaws.com/lakadutof/xadugumo.pdf
    • https://s3.amazonaws.com/kezemiradigu/epson_wf_2630_cartucce_ricaricabili.pdf
    • https://s3.amazonaws.com/fosagoba/lomapowif.pdf
    • https://s3.amazonaws.com/fonazuzixagizir/ravotakibexepavewik.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f16a.bin
af68e5b1f937c352b93499d49ead012793058d2d46d2f20f6aa811b6a9aa50ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF16A 3368 bytes
font_01_sfnt_off0000fd86.bin
8d2297faff6eb4e8a9b39c107c39cf6fdf0a590658a3bf93228ce224c0fb7aa6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD86 5340 bytes
font_02_sfnt_off00010fa3.bin
109d31889e47e649b009caf57abd542b51f2135778443ec0c170b5d98283b32a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FA3 10636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.