Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fc3615e71227db9…

MALICIOUS

PDF

85.4 KB Created: 2021-03-24 18:58:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4bfc609f7638e086d7579dcf33d33ec8 SHA-1: d6ec93caaea79eb09f4d2e566610b8746e5dba02 SHA-256: 5fc3615e71227db9de29b654ae52977565badad44c53fd2bc633b16755794a42
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating high maliciousness. It contains a large number of external links, suggesting a link farm or phishing attempt. The document body, though heavily obfuscated, contains keywords related to technical specifications, likely serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=470uf+16v+capacitor+datasheet+pdf
    • http://zuzimosutikume.22web.org/89297120123.pdf
    • https://zunovuxosuseso.weebly.com/uploads/1/3/4/4/134497136/4254075.pdf
    • https://cdn-cms.f-static.net/uploads/4368782/normal_600e91c36d7e9.pdf
    • https://niwogowepovem.weebly.com/uploads/1/3/4/7/134767936/pisudazesozifarodiw.pdf
    • https://nubiduxabegi.weebly.com/uploads/1/3/1/8/131871606/7b7a6b699d503.pdf
    • https://jifosibupegexuv.weebly.com/uploads/1/3/4/6/134692258/vozonizej.pdf
    • https://sidilatadafexu.weebly.com/uploads/1/3/1/1/131164021/vaweve.pdf
    • https://static.s123-cdn-static.com/uploads/4485926/normal_5feb3af683ac5.pdf
    • https://bukodagunotul.weebly.com/uploads/1/3/4/0/134012399/zinixazorebovawireri.pdf
    • https://zexawowa.weebly.com/uploads/1/3/6/0/136081798/rejujisa.pdf
    • https://cdn-cms.f-static.net/uploads/4485710/normal_603705eb58d7c.pdf
    • https://mumerigowijegap.weebly.com/uploads/1/3/4/7/134771458/196857.pdf
    • https://sudejewakigalo.weebly.com/uploads/1/3/4/0/134040490/xanebun.pdf
    • https://cdn-cms.f-static.net/uploads/4378606/normal_604d82f112c12.pdf
    • https://xajekegok.weebly.com/uploads/1/3/3/9/133997321/kikavafozewera.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/55a94fd1-5769-42f5-aeeb-9429a503c2ae/44839603356.pdf
    • https://8ed7ad90-0d0e-491f-9c15-1f6cd5a61d18.filesusr.com/ugd/f1a804_4693fc01652f42e0af53b64e8f912851.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fbb5607b-cf8b-46de-aadc-e5e5a19381e8/relative_pronouns_exercises_ks2.pdf
    • https://cef8af8d-7071-4339-ac50-fc417d371010.filesusr.com/ugd/a89196_b5c82ad7047f449f86d44db35ddea730.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a1220b5f-7810-4fca-8c59-3da0087abb51/phd_mechanical_engineering_salary_uk.pdf
    • https://bdc3fad0-85dd-4e34-85f7-620d54d4ff6f.filesusr.com/ugd/10cedf_5badbdf16b7349de98d40122a7bf057b.pdf?index=true
    • https://13fad4bf-7224-44b3-802b-16842e97d241.filesusr.com/ugd/b14664_160057dcfa3c4e82b7717c9dcecf8c2f.pdf?index=true
    • http://fizudojaxabite.epizy.com/gym_program_to_lose_weight.pdf
    • https://uploads.strikinglycdn.com/files/1dcf5e03-39ea-4e6f-9801-3248d53abdb1/blackjack_rules_five_cards.pdf
    • https://uploads.strikinglycdn.com/files/ddd350e7-2ee0-44d0-9b3b-f47510cec941/30614288312.pdf
    • http://giwokekurodi.rf.gd/checkpoint_3100_series_datasheet.pdf
    • https://e0f910ba-f4aa-4d6b-87f6-24d78cda99ab.filesusr.com/ugd/cc15ef_f0b5f13c6eb64502a936597b132c11d4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4e1.bin
98980b7fe4328d741e3fc4498e0b44b34f9d034ad4061796deaae9192f55ae33		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4E1 5692 bytes
font_01_sfnt_off00010855.bin
7995981361fe4b133ffae264420b26c72e37fb0d71d6dcc089f7eb7d55c6dddb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10855 12088 bytes
font_02_sfnt_off000131a5.bin
efcda8d0ea25d013786d5cbe7517ed73f55ce1dfb17c74525e0554ea8b1a3d3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131A5 16260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.