Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e63807c9cc4cd85…

MALICIOUS

PDF

104.9 KB Created: 2021-02-04 17:30:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 5d7173b517150204048b1b1255870fc8 SHA-1: 2f9a0c4c583149e66b197578b35ffbc851671767 SHA-256: 6e63807c9cc4cd85e70c8be9771a93ff5984a92ef1daa49234003449fb0f084f
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with several pointing to known malicious redirectors or link farms. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or distributing further malware. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/wb?keyword=black%20desert%20online%20remastered%20pc In PDF document text
    • https://cdn.sqhk.co/doboketuzoj/cB6a41d/mepamova.pdfIn PDF document text
    • https://mimevomakiket.weebly.com/uploads/1/3/4/6/134693464/dodapafotudusakezuru.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367646/normal_5ff923be950bc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489237/normal_60129554052c9.pdfIn PDF document text
    • http://get3creditscores.info/traxxas_e_maxx_manualqegqt.pdfIn PDF document text
    • http://frankiearvelo.com/a_students_grammar_of_the_english_languagey67cf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460688/normal_5feb29b7a2c77.pdfIn PDF document text
    • https://bivofeneduwid.weebly.com/uploads/1/3/1/1/131163561/numes.pdfIn PDF document text
    • https://cdn.sqhk.co/jesisuvov/hiThhS1/kalewesa.pdfIn PDF document text
    • https://vixikubinimagap.weebly.com/uploads/1/3/3/9/133997110/bedatoparegi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zatasipezeg/mitog.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/saziwatikitifuburo.pdfIn PDF document text
    • https://s3.amazonaws.com/remufuzu/macy_s_california_king_sheet_sets.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/54229011363.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD97 14216 bytes
SHA-256: a6b06a508546276802dc6ddb46eb8a00c570ec05f0c8c389158e13efbd33fab9
font_01_sfnt_off00012c2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C2B 5332 bytes
SHA-256: 3c0c9ba7151070427a927abecc606892f574453e1862d9906c42db4a37e40ea4
font_02_sfnt_off00013e2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13E2D 2904 bytes
SHA-256: a0fe2daada3f9176e98494b10909635b23cf183d11683fbcbfedfb157e9710fb
font_03_sfnt_off00014a22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A22 11016 bytes
SHA-256: 93aaad2d120e3883b1c8a96125bd8c44b63d9de12669ccaf119ecda07cbdedbe
font_04_sfnt_off00017008.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17008 21512 bytes
SHA-256: e06d7962ac5127777d797aed972247f0d56c94f305a78cc00dc597ba75797d7a

Open this report in the interactive analyzer, or submit your own file for analysis.