Malicious PDF — malware analysis report

Static analysis result for SHA-256 6607d5730f31adfb…

MALICIOUS

PDF

78.4 KB Created: 2021-03-10 04:06:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 993d1a310da0dccf592ffe2d488026fc SHA-1: 7137b3dd26392346c4a9b40eaa1ce0a558f6ffa8 SHA-256: 6607d5730f31adfb3d41b997359f9af5d39cf3bec4c75bace07aa9637967256d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF sample was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, suggesting it's part of a link farm or SEO manipulation scheme. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic indicate a deliberate attempt to distribute or link to other potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=sister+callista+roy+adaptation+model+example
    • https://cdn.sqhk.co/zujijivopuju/rzqLgcI/gtr_speed_rivals_android_1.pdf
    • https://cdn.sqhk.co/zogugumo/i4Kjdqr/amtrak_viewliner_roomette_price.pdf
    • https://cdn.sqhk.co/zipedufipiz/2TB0rgj/espn_sports_tennis_results.pdf
    • https://buliduxefexefux.weebly.com/uploads/1/3/1/6/131636978/mapakanupanid.pdf
    • https://cdn-cms.f-static.net/uploads/4389801/normal_6034f479cbf64.pdf
    • https://static.s123-cdn-static.com/uploads/4371244/normal_5fed43689065f.pdf
    • https://cdn.sqhk.co/baruduwege/ihfPmhe/love_rosie_quotes_no_matter.pdf
    • https://cdn-cms.f-static.net/uploads/4497093/normal_6034edb7f00c2.pdf
    • https://cdn.sqhk.co/votezevon/8geghXt/90436103536.pdf
    • https://cdn.sqhk.co/tisufupujeli/BZhhkhj/pew_pew_pew_song_official_video.pdf
    • https://cdn-cms.f-static.net/uploads/4501383/normal_60437e6f235c1.pdf
    • https://mitumeme.weebly.com/uploads/1/3/4/8/134879381/defapip.pdf
    • https://cdn.sqhk.co/vekuperik/jfGeX1q/texevukatosim.pdf
    • https://kobizixudowizeb.weebly.com/uploads/1/3/4/4/134402546/lubupawurow.pdf
    • https://cdn.sqhk.co/mafowixodi/cgfigje/marshmello_face_costume.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2f68a6d2-cd58-487f-8cb8-4779057deef5/58614134623.pdf
    • https://uploads.strikinglycdn.com/files/04fbf1e3-ddfd-44e2-a2f0-9bfde705e586/romajanibijubovedodata.pdf
    • https://s3.amazonaws.com/lakujusitejojet/how_to_reset_password_on_a_swann_camera_system.pdf
    • https://s3.amazonaws.com/begijufadi/16429433038.pdf
    • https://s3.amazonaws.com/fukepez/algebra_1_homework_practice_workbook_glencoe_mcgraw_hill.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7c5.bin
a43d0ebd09873dccb69bf9cb7c57bf6f23c7cd0d160e0ec3b030dd0c5eff55c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7C5 5492 bytes
font_01_sfnt_off00010a6c.bin
42e8f6240addd456b462f15b192f530d24ab143370bdb50e7a72430dab745f6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A6C 9800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.