Malicious PDF — malware analysis report

Static analysis result for SHA-256 71a4da3af1a67aca…

MALICIOUS

PDF

94.9 KB Created: 2021-05-09 15:05:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f1331d7d509a5e04a7a038fc0d9486e SHA-1: 1580b92a18093c198efd7a771ca2d735de2fdd74 SHA-256: 71a4da3af1a67aca72111a1878a6f933c6f5e438fa7bb51717ad3980abc0ce2c
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan distribution attempt. It contains a large number of external links, many of which are likely part of a link farm designed to obscure the true malicious destination. The document body, though heavily obfuscated, suggests a lure related to 'sermones adventistas en pdf 2020', likely to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=sermones+adventistas+en+pdf+2020
    • https://cdn.sqhk.co/javukapegami/dhi9hip/zepiwed.pdf
    • http://kakolamilasaru.medianewsonline.com/jexif.pdf
    • https://cdn.sqhk.co/febowozefu/cPghiga/91726081473.pdf
    • https://cdn.sqhk.co/remozemot/WhcC9hi/bijatuxuvorapewepulaz.pdf
    • http://trysoda.pro/us_army_field_tablev9ily.pdf
    • http://zogometemo.sportsontheweb.net/vamatafugegiteten.pdf
    • https://cdn.sqhk.co/nikofejujel/8jghem2/car_x_drift_racing_2_mod_ios.pdf
    • http://lilubaxubaxulu.sportsontheweb.net/wendys_hamburger_nutrition_value.pdf
    • http://fabujisaw.mygamesonline.org/sugapubejewodezafoveka.pdf
    • https://cdn.sqhk.co/jekunesoru/ifjejhI/surok.pdf
    • http://reactivaperu-viabcpi.com/taxafemigi6iltj.pdf
    • http://arnautmebel.ru/john_lennon_imagine_sheet_music3jr4g.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7e574f8b-ef34-4833-8dee-b18f3ac9fc91.filesusr.com/ugd/af8ffd_3dc6306191634a39b8bd31b15e0c0d01.pdf?index=true
    • https://bfb79b04-db4d-4c54-a74a-4733ff68ceb9.filesusr.com/ugd/11291b_33daff5fc79143baaa1f599c11ac735c.pdf?index=true
    • https://c5b3e1fc-3b55-407d-a8d9-2bfa6c9015c1.filesusr.com/ugd/6df244_c033faeb8fd04e37a6437f768a80d1c9.pdf?index=true
    • https://0503187d-52cd-4237-9521-a3cb9bf551ae.filesusr.com/ugd/5bb01c_837fa7e2d44a4ceb984057229c8c5cdf.pdf?index=true
    • https://b5f169ef-6bcf-4d19-a24b-32bdc9dd7a5f.filesusr.com/ugd/2e79a6_02ba65e594454e969eb3204ae789f814.pdf?index=true
    • https://aca292c6-a3ee-4c96-b4c9-db15c8eca1b9.filesusr.com/ugd/cd1d52_6678d730dd1f467f8199bb69a34c3f12.pdf?index=true
    • https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_17b1fe37d9884af5a810cf0e6c410428.pdf?index=true
    • https://724418e0-3ace-43c1-abd8-628b4820fc71.filesusr.com/ugd/6df952_661ba82ec1a34d42a6e74f7d2e696d1d.pdf?index=true
    • https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_41fafe7aa60244fb9bf677491896932b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000130be.bin
954421435c6143f883a67d8d57073b286645e67038ee1a5c7d83391991e5a6ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x130BE 5592 bytes
font_01_sfnt_off000143b6.bin
9ccada67b7205e943b21c49d25d4f110172435814aaa91e562e9d3f2d7ab23c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x143B6 12752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.