Malicious PDF — malware analysis report

Static analysis result for SHA-256 6182a3e8c3999b11…

MALICIOUS

PDF

68.1 KB Created: 2021-03-30 02:04:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1003b7a4237eff4f5f03d98bd56670b1 SHA-1: 4774a85a2a393f811d0befe1ccfac66872a109eb SHA-256: 6182a3e8c3999b11e553b609071cbf6e63985c53f51ec00056d698fce09f0f46
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to SEO-optimized PDF documents, suggesting a link farm or content manipulation tactic. The presence of a ClamAV detection for 'Pdf.Phishing.Trojan' and ML classification further indicates malicious intent. The embedded URLs likely serve as lures to phishing sites or downloaders for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9490

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=ausfta+declaration+pdf
    • https://cdn-cms.f-static.net/uploads/4413125/normal_600da42454ca5.pdf
    • https://cdn-cms.f-static.net/uploads/4486363/normal_604cc3addc8be.pdf
    • http://streamsweets.com/what_colour_is_an_object_that_does_not_reflect_any_lightu7wp5.pdf
    • https://cdn-cms.f-static.net/uploads/4426075/normal_605111fd11786.pdf
    • http://creditscorefix.info/irobot_roomba_870_user_manualt3tz0.pdf
    • https://cdn-cms.f-static.net/uploads/4410702/normal_5fd7a55831ab9.pdf
    • http://paktum.pro/88748726340zhgzh.pdf
    • https://cdn-cms.f-static.net/uploads/4407777/normal_60115c0559e67.pdf
    • https://cdn-cms.f-static.net/uploads/4411252/normal_6039234229346.pdf
    • http://look-hotel.com/pharmacotherapy_a_pathophysiologic_approach_9th_edition_free_downloadrn5mi.pdf
    • https://cdn-cms.f-static.net/uploads/4373770/normal_600df4a339eb6.pdf
    • http://conicppjry.bid/does_samsung_smart_tv_have_screen_mirroringdvrx2.pdf
    • https://cdn-cms.f-static.net/uploads/4387925/normal_606247ec5761d.pdf
    • https://static.s123-cdn-static.com/uploads/4463560/normal_5fc6f5f138242.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/08828f69-b511-4874-81b5-e01bb76f75f4/74483761607.pdf
    • https://a8fdb364-3865-4521-a36b-e12f4de7752f.filesusr.com/ugd/e20637_9c4f6874de734f4999a0f4c86c116299.pdf?index=true
    • https://acaa17bf-cf2e-4132-a9e9-810271eb8bc4.filesusr.com/ugd/ab5b4c_37ca837c2f3941db91a5a1bd28bb7080.pdf?index=true
    • https://2f2ab42d-e0b4-4bd3-aa50-2430da1ff5fc.filesusr.com/ugd/eaf48f_9a005e9dfcf4420486467824ec0f23e1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/dad289ee-8750-457d-a793-35c67b42f328/what_kind_of_pasta_is_in_minestrone_soup.pdf
    • https://uploads.strikinglycdn.com/files/ca0018c0-f747-49ea-bdb7-75e18b210150/descargar_cancion_de_ana_gabriel_huelo_a_soledad.pdf
    • https://49d0234c-aae4-472d-9cb9-6192e9e03354.filesusr.com/ugd/a63595_86a588f4de154e448b4527c6cf6008e7.pdf?index=true
    • https://2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com/ugd/3794ad_c447f14e4ca74b75ad528c346437a150.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d5f039b7-eb16-403b-9e81-dae625c2d23d/roadmaster_granite_peak_mens_mountain_bike_26_wheels_review.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e10d.bin
d92dd96c81dc349d2122ca85e2488c854849bd94675feac3c0f324a52d041bd1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE10D 5020 bytes
font_01_sfnt_off0000f21c.bin
a0f626ac5da58d7aa0a2cbae08bf8f7f918e0c8fa1f6e1f48ee99616aeeb1ce3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF21C 10600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.