Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c7aea8ab0a2c9e1…

MALICIOUS

PDF

88.9 KB Created: 2021-03-16 11:06:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 38292b21016da06f3e37aeacb16bd918 SHA-1: 7d0c254944699e1cf5f342b2dcc8deedd2794c2c SHA-256: 6c7aea8ab0a2c9e11d6156f36fd0ab8a11f8ed2226cf015f746b3747b33c92f7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier with a high confidence score. The PDF contains a large number of external links, characteristic of SEO spam or phishing campaigns. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=computer+all+hardware+parts+name+pdf PDF link annotation
    • https://tegubefebax.weebly.com/uploads/1/3/4/4/134431627/30722a.pdfIn PDF document text
    • https://bikigevoxepasi.weebly.com/uploads/1/3/4/7/134716722/5d76e69888.pdfIn PDF document text
    • https://kajukuka.weebly.com/uploads/1/3/4/3/134307777/6602441.pdfIn PDF document text
    • https://kisewosa.weebly.com/uploads/1/3/1/0/131070890/tobolukurog.pdfIn PDF document text
    • https://vobudogekatobef.weebly.com/uploads/1/3/0/8/130874620/1063457.pdfIn PDF document text
    • https://luwojasog.weebly.com/uploads/1/3/1/3/131380471/luzum.pdfIn PDF document text
    • https://mafenipo.weebly.com/uploads/1/3/4/8/134879688/wupujasoxaxuwo_popipumamajove.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xiwevitox/the_choice_edith_eger_amazon.pdfIn PDF document text
    • https://s3.amazonaws.com/desekusoxi/comic_book_free_cbr.pdfIn PDF document text
    • https://s3.amazonaws.com/wunupalezozerud/bullseye_fortnite_cheat_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/dixaleko/17613576815.pdfIn PDF document text
    • https://s3.amazonaws.com/pasutiz/besalifafexibu.pdfIn PDF document text
    • https://s3.amazonaws.com/robumuduluwise/how_to_unclog_my_keurig_needle.pdfIn PDF document text
    • https://s3.amazonaws.com/fikuvine/learning_to_read_and_write_frederick_douglass_essay.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/creality_ender_3_pro_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/viboxikuz/android_phone_app_keeps_stopping.pdfIn PDF document text
    • https://s3.amazonaws.com/popisiburewixuj/format_json_python_command_line.pdfIn PDF document text
    • https://s3.amazonaws.com/punurum/kiwujutovewinevuremu.pdfIn PDF document text
    • https://s3.amazonaws.com/retisovojor/did_ancient_greece_have_a_government.pdfIn PDF document text
    • https://s3.amazonaws.com/nutanigonu/has_the_amber_spyglass_been_filmed.pdfIn PDF document text
    • https://s3.amazonaws.com/dobesogum/71714544427.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011feb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11FEB 5276 bytes
SHA-256: 7f83513889ae0bb56493b2816bce92458a3fdfb08c8a2da2bb4e611fa7eade7a
font_01_sfnt_off000131b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x131B9 10812 bytes
SHA-256: d9711e99bd57df8c523f1b36dd81c8c0b526c6c8ec9b7a54c80c12e67def1ff1

Open this report in the interactive analyzer, or submit your own file for analysis.