Malicious PDF — malware analysis report

Static analysis result for SHA-256 712d0ef18bf104d5…

MALICIOUS

PDF

93.8 KB Created: 2021-04-04 23:15:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5fc37c5564cd28e27eec48215966c60e SHA-1: 934787917e7994177535e84738c2b7158e217c75 SHA-256: 712d0ef18bf104d5046b99c1144b74d39e1daf6ddeec81409c13115fc47fff20
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, including a link farm, suggesting it's designed to redirect users to potentially harmful websites. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=canon+9000f+manual+pdf
    • https://cdn.sqhk.co/bupabumo/UkTq0jc/talunuki.pdf
    • https://cdn.sqhk.co/jupufopil/gcMOhd7/vamuzexo.pdf
    • https://cdn.sqhk.co/reriwoduriju/4oPVhdv/ball_drop_nyc_2020_video.pdf
    • https://cdn.sqhk.co/walekikem/bLM9nie/real_car_driving_3d_mod_apk.pdf
    • https://cdn.sqhk.co/dikizumi/jf7jihi/48135951134.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1eb3b35d-1eda-4d19-b521-6bf3bb272f19/how_much_does_it_cost_to_own_a_cessna_172.pdf
    • https://s3.amazonaws.com/jarawaxanivu/wutozidezuluvidizafupi.pdf
    • https://a765b249-d442-4b07-8ea9-8318d996b894.filesusr.com/ugd/902d29_09d89c1cc591445fa5dc1afa373093de.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c7d18a1e-a7a0-41fb-85cf-3b2ec6f388db/venozuvakowulesaxogugobus.pdf
    • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_ecef5b9392cf4aa2ab37a026b39eb771.pdf?index=true
    • https://55d63786-14d6-44de-84d0-33f1fb383c44.filesusr.com/ugd/45fd81_f42aa957de564e4682c1440f3bcc8ce6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/961500e0-15b0-489c-8d37-a48802d7ed48/robert_adams_middle_school_calendar.pdf
    • https://85ed388a-52e0-4e79-9737-9d4b769dda71.filesusr.com/ugd/bb10c5_7e4ab9511f774b36b619ceef209a8b70.pdf?index=true
    • https://a2214900-82f6-4ed5-a432-d5ffd14110fa.filesusr.com/ugd/306b6b_fb898d2d37884c0896383d4ac002757a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/604b592e-6047-4a98-90c2-b775b997b4e0/why_do_i_feel_pain_when_i_see_someone_hurt.pdf
    • https://s3.amazonaws.com/lopeteb/espn_fantasy_football_cheat_sheet_2018_standard.pdf
    • https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_a1ba9766cc5e42a1925adbcd5dce7a9f.pdf?index=true
    • https://af431a04-9ebc-4ea4-a98d-45e4ffbfad14.filesusr.com/ugd/485053_6e08ff8736234633b822708e19697f55.pdf?index=true
    • https://s3.amazonaws.com/fowikorejodi/android_espresso_wait_seconds.pdf
    • https://b54663a3-ff9d-4122-b75c-69b71428c9b0.filesusr.com/ugd/cfa91a_0f4d9588c54d4654b6f3f486889b05e2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1b67b7ca-a976-4bca-8dff-1d3999f4382c/yamaha_golf_cart_manuals_free.pdf
    • https://3176e400-c268-4dc0-8d69-08eae86937f8.filesusr.com/ugd/ea2f88_704ab2c41a8e41e5acb1f880e469b4f6.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e406.bin
38bcc78d0296620bb6e8250f33167d7969ea46f39e16f6ecb4abbd6370ef3b42		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE406 24308 bytes
font_01_sfnt_off000130b3.bin
4b6b4549f3eed9bb8074cc1ff590a64564f7e57c7beda320bd5cc06005db7538		 pdf-font-stream PDF embedded font (sfnt) at offset 0x130B3 5116 bytes
font_02_sfnt_off0001420c.bin
26d1b2ab4dd8c9deb84e4bf29a2d07b7a94e75c1ddb6d8fdb26189eb6046f9e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1420C 11388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.