Malicious PDF — malware analysis report

Static analysis result for SHA-256 6306dc5df206537b…

MALICIOUS

PDF

81.9 KB Created: 2021-03-22 17:29:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e7f550d198771d56edc4ce85044bc301 SHA-1: 2dbf41dacc4b693ac9ec7b2014bb8722a1b9c9a4 SHA-256: 6306dc5df206537bcb44ccbb90df60ad4105da780839851e9935054227ca54bd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting a malicious intent to redirect users to potentially harmful websites. ClamAV detection and ML classification further confirm its malicious nature. The presence of embedded URLs and the overall structure point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=hand+meat+mincer+for+sale
    • https://cdn.sqhk.co/vinasujitupe/yc86jh8/international_superstar_soccer_deluxe_free_download.pdf
    • https://cdn.sqhk.co/toxodabatot/CgigfJ3/open_puzzle_box_level_50_answer.pdf
    • http://uabiomanix.xyz/they_say_i_say_sample_essayxob8d.pdf
    • https://cdn.sqhk.co/letarezetap/CKsihKb/40504930244.pdf
    • http://coloradocustomelectric.com/boye_loom_set_patterns6xs9q.pdf
    • http://poverkavoda.website/negative_space_drawing_definitioni8owu.pdf
    • http://tiktoktop.design/why_wont_my_radio_turn_ondxm5b.pdf
    • https://cdn.sqhk.co/kawurefeki/jciggcO/ww2_aircraft_names.pdf
    • https://cdn.sqhk.co/mujawiru/hjjzt6x/3469562673.pdf
    • https://cdn.sqhk.co/pategazikiw/bghgeAx/mine_survival_hack_free_download.pdf
    • https://cdn.sqhk.co/vigefifobot/iejivjb/picsart_apk_mod_12._9._3.pdf
    • https://cdn.sqhk.co/fokudiwun/iihgRhh/12442296977.pdf
    • https://kakituku.weebly.com/uploads/1/3/4/5/134589995/718bf.pdf
    • https://cdn.sqhk.co/begokaxawip/gejc2jf/80833201859.pdf
    • https://getenulezawo.weebly.com/uploads/1/3/4/8/134897364/2becc246282.pdf
    • https://cdn.sqhk.co/lawafopugu/idic84R/deluxe_weekender_travel_bag_vera_bradley.pdf
    • https://static.s123-cdn-static.com/uploads/4492529/normal_5fcd65ecd1fa4.pdf
    • https://cdn.sqhk.co/wamamuli/nOgcKig/ualberta_law_library_hours.pdf
    • https://cdn.sqhk.co/nasanoroge/MihchfW/3_week_look_ahead_schedule_excel_template.pdf
    • https://cdn-cms.f-static.net/uploads/4379856/normal_6036c4e770996.pdf
    • https://susemozud.weebly.com/uploads/1/3/2/8/132814624/214e884.pdf
    • https://cdn.sqhk.co/nujusowidom/4gjhgdz/mini_golf_dallas_texas.pdf
    • https://cdn.sqhk.co/vilubofi/bheihKV/14312174658.pdf
    • http://women-ita.space/wedding_planner_startup_costsk5e8d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100f1.bin
565a43a7ea48393e5ecff89057a8f4e3cb3645e914f3f8e040279d648338549d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100F1 5128 bytes
font_01_sfnt_off0001124b.bin
c57118c303cad95b48b3e25c9c0e67d9416ef1eb1fcc0ffe0be33a86febac3fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1124B 11144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.