Malicious PDF — malware analysis report

Static analysis result for SHA-256 670f298c8450c1e5…

MALICIOUS

PDF

74.1 KB Created: 2021-03-22 02:57:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 72bb396814474263b911b68dfd321c2a SHA-1: ddf947fdd627b5c961bd0fe1b047a9a10717a13e SHA-256: 670f298c8450c1e53186e829bc9b3380e1d13e97c32061a62d2558235c4b591f
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing document with a large number of external links, likely for SEO manipulation. The embedded URL points to a domain associated with potentially malicious activity, and the document body, though heavily obfuscated, suggests a lure related to file conversion tools. The ClamAV detection further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=exe+to+apk+converter+tool+free+download+for+pc PDF link annotation
    • https://cdn.sqhk.co/jebixusugak/Egfgjhg/bamirudulupebirajeponid.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374682/normal_6000f15a288a6.pdfIn PDF document text
    • https://cdn.sqhk.co/bebumila/7ieChip/kajeninuvukavo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465386/normal_603a3e671e85e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388626/normal_60530af0b58a0.pdfIn PDF document text
    • https://cdn.sqhk.co/zonurubo/eijie2i/pixemufefuka.pdfIn PDF document text
    • http://fesadivu.iblogger.org/defufevuz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pirosisob/18506363921.pdfIn PDF document text
    • https://99442e0c-e188-470f-b1e9-a2082f9e7f28.filesusr.com/ugd/2274a7_be957da4e6cf47f6be91ae2c203e1590.pdf?index=trueIn PDF document text
    • https://e6e31949-ba74-43ae-8e0c-2243355e89fd.filesusr.com/ugd/69e259_bfd369f5064e4f62aa6614a852df96bc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zaxawetawupo/33660980292.pdfIn PDF document text
    • http://biwuwilanu.epizy.com/combined_annual_return_form_13.pdfIn PDF document text
    • https://s3.amazonaws.com/rirusozo/gusudubexaruga.pdfIn PDF document text
    • https://s3.amazonaws.com/luborinizu/winter_weather_forecast_2021_oregon.pdfIn PDF document text
    • https://6998e30b-c911-4113-ab34-4c15204891c7.filesusr.com/ugd/429b25_d3b291e92350462790bc7c0980f284d7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/woxotopapozokev/sturdy_autoclave_sa-_300vl_manual.pdfIn PDF document text
    • http://situxunekidini.epizy.com/lotus_caravans_tremor.pdfIn PDF document text
    • https://3d3b31fc-6152-41c7-b1d4-a4af3afcce63.filesusr.com/ugd/3f8d85_a7be2979cadc402cb5e54e4729048f56.pdf?index=trueIn PDF document text
    • http://dafiwogi.rf.gd/greensleeves_piano_easy_sheet_music.pdfIn PDF document text
    • https://3857ddc0-2b33-46ba-b4a8-ebef9b167687.filesusr.com/ugd/5cc0d5_09db95ec2acb4c81bbdfe7625d046792.pdf?index=trueIn PDF document text
    • http://bexufomadixin.rf.gd/company_of_heroes_cheats_steam.pdfIn PDF document text
    • https://be9ca920-c372-4566-b00d-544f92814f3b.filesusr.com/ugd/f0c5a9_e337ada0678e45889a2b1d414ee46131.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e422.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE422 5212 bytes
SHA-256: 965329ce6887e19b803ff52b5c83fdb3fed41680daac1d89fbea590bedf8fe84
font_01_sfnt_off0000f611.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF611 10848 bytes
SHA-256: 9ad7462577bbfeb05a38b075a655027fd57c4613767f41af1ab3f70c8206ee99

Open this report in the interactive analyzer, or submit your own file for analysis.