Malicious PDF — malware analysis report

Static analysis result for SHA-256 69421cc2b5f4bbb3…

MALICIOUS

PDF

83.6 KB Created: 2021-03-16 09:40:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bdca7c152c3d8c075c6609a745240825 SHA-1: 245fead6d144e06f0afa3e0377f6a3033752d398 SHA-256: 69421cc2b5f4bbb327f8188cd80361c47474b469d77d897d837a4feb436b8e5c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used in link farm attacks to improve SEO for malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. The embedded URL points to a domain associated with keyword-based redirection, suggesting a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=english+grammar+quick+reference+guide+pdf
    • https://cdn-cms.f-static.net/uploads/4475985/normal_600b17ba7b28d.pdf
    • https://static.s123-cdn-static.com/uploads/4424405/normal_5feeb04569d7a.pdf
    • https://cdn-cms.f-static.net/uploads/4371786/normal_603bcba0ba4f3.pdf
    • https://static.s123-cdn-static.com/uploads/4450426/normal_5feb7ba0bd541.pdf
    • http://nowtorrentz.com/79497175317ha0t2.pdf
    • http://soinjaga.ru/togokisovevoxuziwonobaj4xgd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/ad392aa6-4e16-4138-a6b8-1327f3738c44/gigijadedep.pdf
    • https://uploads.strikinglycdn.com/files/759611d3-b7ee-4d96-b8aa-6a26a0f3077a/wibadowujewasodomopetaf.pdf
    • https://95a83a18-022f-4aa5-9dc2-588eac4c5c4a.filesusr.com/ugd/ccb6ab_ac1e3660cf2f4708addfe22ed369b790.pdf?index=true
    • https://uploads.strikinglycdn.com/files/706cacb4-1e74-4ea9-84e9-a083c670d0aa/20112165538.pdf
    • https://16012499-1299-48b0-8cdd-5f23a7749958.filesusr.com/ugd/fafc38_f91e7d289b89415b9dce55e1ed04fb11.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5d414393-0dde-4338-99b6-f54976e3f80b/how_long_to_cook_chicken_in_vertical_rotisserie.pdf
    • https://uploads.strikinglycdn.com/files/a53669c4-f341-40a2-9c16-2326fd1c751e/spirit_and_grace_by_ricky_manalo.pdf
    • https://uploads.strikinglycdn.com/files/2a55c655-3f20-4a41-b5eb-b63444166b6c/32714319860.pdf
    • https://d3826037-6016-486c-99e9-dc41bc666644.filesusr.com/ugd/b81754_4abc843f3fbb4dcb9a9fad557c75e575.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c27f1205-dcee-47c2-9d60-c204db88ca1c/king_henry_doesnt_usually_drink_chocolate_milk_story.pdf
    • https://uploads.strikinglycdn.com/files/dc8cf132-0cae-420c-837e-56c2f19fdb4d/casio_g_shock_4778_manual.pdf
    • https://uploads.strikinglycdn.com/files/a8f33349-60a9-448e-81a2-b577b325bea8/cuantas_calorias_tiene_una_cucharada_de_miel_de_caa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9e4.bin
c4e5c901105853bf6b24b35b874e47924a45d442d487ab8f85bf190af702df9a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9E4 5408 bytes
font_01_sfnt_off00010c0c.bin
c5dc25b29c5c5f64af0eeaf6e4ae5c20b11f1b5f175f1fd752439eb40ac42c54		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C0C 11560 bytes
font_02_sfnt_off0001331f.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1331F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.