Malicious PDF — malware analysis report

Static analysis result for SHA-256 71cce6bca78c58d5…

MALICIOUS

PDF

81.5 KB Created: 2021-05-04 23:05:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b1c4564ae6d76ab97099cf2c9f7bbf30 SHA-1: 70fa681bdedf671dd44fa1623b29c63a1957a0ee SHA-256: 71cce6bca78c58d5406067d052b962f92aa4e23c53c87bd0f07d1243a13d9d5c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent URL pointing to a suspicious domain, suggesting a phishing or scam attempt. The document body, though heavily obfuscated, appears to contain keywords related to 'VHF marine radio frequencies australia', likely used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=vhf+marine+radio+frequencies+australia
    • http://pasiworuwiwoz.getenjoyment.net/bula_arcalion.pdf
    • https://removevas.weebly.com/uploads/1/3/4/4/134443453/5656724.pdf
    • https://wulejowaru.weebly.com/uploads/1/3/4/8/134886315/7195309.pdf
    • https://guxitokos.weebly.com/uploads/1/3/2/6/132681611/waregit.pdf
    • https://zifimebitumane.weebly.com/uploads/1/3/4/2/134236425/3ced1c31.pdf
    • https://viwekaxirudadax.weebly.com/uploads/1/3/4/7/134700275/nizukuxejejetapux.pdf
    • https://xojumupaxasa.weebly.com/uploads/1/3/4/6/134605953/kavimu-tezajujuji-majenatifi-sobidosovotiwun.pdf
    • http://jexekiraj.sportsontheweb.net/zedumexusoboxo.pdf
    • https://pejoguroboxifuj.weebly.com/uploads/1/3/1/6/131637830/b60d5f39e97b4c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ca6b24e6-01cd-4368-a310-1df05077a315.filesusr.com/ugd/11b39a_f5e3b3c0120746bca7f2398e28b623fb.pdf?index=true
    • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_71a19eb22c4d41e295d20b7a3b417768.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8f79e49e-09cf-4e38-8ba1-bc0ad9994bc5/pokemon_gaia_walkthrough_precimos_island.pdf
    • http://gamelaluwer.myartsonline.com/62552498611.pdf
    • https://e86c6366-0652-46cb-9e1f-5633a133dba9.filesusr.com/ugd/510a18_4715b55a51db4de88e79cc4a19e1c036.pdf?index=true
    • https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_daae3f1c3b52471a82ff1f9fe19df93e.pdf?index=true
    • https://69f6cc44-9198-4e41-bafa-43503dba92bf.filesusr.com/ugd/dec231_c188a2af918e4aca9a644b717bc55551.pdf?index=true
    • https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_582dc8eba7ed4b748fe9875c23ddd501.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1423c482-01d1-45b0-a30e-858d8a3c399f/2007_freightliner_columbia_radio_wiring_diagram.pdf
    • http://kususen.myartsonline.com/nupiwenupalozosisifa.pdf
    • https://584abdf6-e408-48d3-a53c-4313a8f82471.filesusr.com/ugd/18ee90_3ade9e55799149f7a701855d9bcba73d.pdf?index=true
    • https://55f5e71c-5f54-469f-9449-301c43944234.filesusr.com/ugd/bbdb65_6c8c9092d80b4d548a2bd708c6e8bf54.pdf?index=true
    • http://pabewuvuxaf.onlinewebshop.net/what_is_the_difference_between_modernization_and_westernization.pdf
    • https://ce55c564-0e79-48ac-bd91-a034cff8554b.filesusr.com/ugd/bd1fc0_0ef27099c9aa4719acd06b69f454fd71.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010018.bin
58fad7b3adaf385d4d83de06927a2168838cbfe41556905cbca09ddfd6ddbed1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10018 5352 bytes
font_01_sfnt_off0001121c.bin
9a32f36ddefd775c7056b1f92e34444df5f2c00ab934613c24e62a6f39bdad0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1121C 11268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.