Malicious PDF — malware analysis report

Static analysis result for SHA-256 6abc6a602780d1c4…

MALICIOUS

PDF

68.2 KB Created: 2021-03-08 00:48:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 210036609c61d133d31c77755be3d140 SHA-1: dae226b8f80de0b9b84b9b7cf3426ad47c891966 SHA-256: 6abc6a602780d1c48290705be29140b63adde46fea0f5953ffea0e75b02d872a
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=aerial+silk+beginner+classes+bay+area+ca PDF link annotation
    • https://cdn.sqhk.co/dajebala/cihHV5q/slack_stock_forecast_zacks.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449000/normal_6035808045d9b.pdfIn PDF document text
    • https://cdn.sqhk.co/zavufepugife/hhiKnhO/jemadefojasewetabeto.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454819/normal_5ff5764233d78.pdfIn PDF document text
    • https://cdn.sqhk.co/vovewotutal/4aCjnts/mawuxex.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475872/normal_5fee042aa934e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419849/normal_5fee6f8fa201e.pdfIn PDF document text
    • https://cdn.sqhk.co/gazejuruni/6eikcQL/vuwewutoteroletemurezejo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f50dd29-e403-460d-8f22-36e729d256b7/21811383562.pdfIn PDF document text
    • https://f8d82b49-d438-4da2-b906-f876cb6fe635.filesusr.com/ugd/12dc78_bf4db462106448489fe11ccf83185b52.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zumezeviwakiz/waropiwijenokoparofu.pdfIn PDF document text
    • https://9849c7ec-8b19-4b81-9a64-db2537ea7c40.filesusr.com/ugd/97b1c0_6ec00496109a4a70a3a2225b16835cdb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/97592c54-57a9-4812-9e9c-d2bd352ee2c1/ashton_woods_houston_jobs.pdfIn PDF document text
    • https://s3.amazonaws.com/bupijila/vbspu_registration_form_2019.pdfIn PDF document text
    • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_73bf268283fc4d0c8ea63d5ca802c655.pdf?index=trueIn PDF document text
    • https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_c744e80498b24c869f0ba6811b472e1a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wizakokowe/31978964042.pdfIn PDF document text
    • https://0f926834-650c-4d5a-b53c-ad60ae412ccc.filesusr.com/ugd/6a44d8_af1e15e3cbde48a8b70d9f4157a4cd9c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gudukupir/alder_lake_wa_fishing_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f21d2ab8-b501-4e8b-97e2-8b5350fb86ad/luvudi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59dd4563-9639-4678-8aca-07604b02bc2f/free_online_coaching_tools.pdfIn PDF document text
    • https://s3.amazonaws.com/liwara/jinumifoluj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ce5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCE5E 5260 bytes
SHA-256: 855f7d32a9c8766c1ec29b20b4b8405fc5d7a55e3a414180faf4e40f738f1f9b
font_01_sfnt_off0000e05e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE05E 10240 bytes
SHA-256: 9b199c9b548f269f447aae02313644b4682da6a185a9bbd4e3b155d35f800161

Open this report in the interactive analyzer, or submit your own file for analysis.