Malicious PDF — malware analysis report

Static analysis result for SHA-256 5eae56bd52ffe3df…

MALICIOUS

PDF

73.5 KB Created: 2021-03-20 06:38:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 356c5af4865adde256321277a086a3b2 SHA-1: 5d9aa882aad56e306e784c58a1f02bfead52b43b SHA-256: 5eae56bd52ffe3df2989ff3c7a79454ddba6a3772c3090c6607040befab1e3cd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one specifically pointing to a URL related to a 'harry potter lego achievement guide'. This suggests a tactic to drive traffic to potentially malicious or spam websites. The ClamAV detection and ML classifier flagging indicate a high likelihood of malicious intent, possibly related to phishing or SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=harry+potter+lego+achievement+guide PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4495413/normal_5fd070735b334.pdfIn PDF document text
    • https://cdn.sqhk.co/rifojimuna/pHCibpo/92008898409.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392857/normal_5fe006717ecd3.pdfIn PDF document text
    • https://cdn.sqhk.co/lunajevon/NhbrvyQ/baccho_ka_game_ki_video.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450639/normal_5fdb004c9f4d9.pdfIn PDF document text
    • https://cdn.sqhk.co/kewudomavave/hgfijZL/sodixub.pdfIn PDF document text
    • https://cdn.sqhk.co/xawenano/bCgjbih/christian_coloring_pages_for_preschoolers.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421944/normal_6002f4f35087b.pdfIn PDF document text
    • https://cdn.sqhk.co/timadupak/aghibNc/faderowexex.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tobojelusiwi/prepositional_phrase_worksheet_7th_grade_with_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/biwubeleba/22762295790.pdfIn PDF document text
    • https://s3.amazonaws.com/baxunaf/how_to_tell_if_power_converter_is_bad.pdfIn PDF document text
    • https://bb491b24-4c81-4ccc-8daa-bf1baeb171c2.filesusr.com/ugd/93c935_7bebb1d1c2b747f58652926ecac22ee0.pdf?index=trueIn PDF document text
    • https://08b4a39d-fa16-4eaa-91be-ae90003cacb9.filesusr.com/ugd/237bf7_58d62157e67c45d59ad86caffc483190.pdf?index=trueIn PDF document text
    • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_bd3da8bac5ba4cd4a717cfe3c2561832.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/risisipajole/forms_of_energy_worksheet_8th_grade.pdfIn PDF document text
    • https://s3.amazonaws.com/juwofuxufijup/2014_camaro_zl1_performance_upgrades.pdfIn PDF document text
    • https://s3.amazonaws.com/tobobowu/37381553148.pdfIn PDF document text
    • https://56f9ebfc-1b58-4ccd-90b9-24793863e956.filesusr.com/ugd/0f3536_cb130333b0be45afa6936d62cbe15494.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/62e0cfc0-b725-4a32-b33b-08c0ef4a73ea/71209461263.pdfIn PDF document text
    • https://s3.amazonaws.com/kujapomib/rexig.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68481a31-0c10-4579-8c9d-05748f952aa5/the_5th_wave_second_book.pdfIn PDF document text
    • https://a3e8d6b6-68ee-4625-a313-a25a09dbd39d.filesusr.com/ugd/312e12_52076866ba8640edb5bd2b2c797e69f8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fuvidokibet/best_defensive_drills_for_high_school_basketball.pdfIn PDF document text
    • https://s3.amazonaws.com/fajixe/75834392294.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/61f0d6bf-e918-48bb-a8bd-2d3ec6cef6e0/99972666834.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF7F 5432 bytes
SHA-256: 941e51d2f9fc641d374491bb7a8234f11528234de56d0efced2aeed4e43a84ea
font_01_sfnt_off0000f1da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1DA 10676 bytes
SHA-256: ed15e82f8666c3d2088df643fa489a85c0a84d3092632650f151ddc82d75a484

Open this report in the interactive analyzer, or submit your own file for analysis.