Malicious PDF — malware analysis report

Static analysis result for SHA-256 723193a4a554bd50…

MALICIOUS

PDF

72.5 KB Created: 2021-03-08 14:41:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5dfc2f2419f3daec76eb8d2596cf1fde SHA-1: bb5c5d7d656871301526d1989a53c5de2fb58884 SHA-256: 723193a4a554bd5089cb60ae001b9468b36b7ecbfb15f8993c11b5b779cf176d
236 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing and link farm attack. It contains numerous external links, many of which are disguised as CAPTCHA pages or search results, likely intended to redirect users to malicious websites. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic suggests the document may also be part of a multi-stage attack involving password-protected archives.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 7

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
    PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=briggs+and+stratton+19.+5+hp+engine+repair+manual+pdf
    • https://nidabiweni.weebly.com/uploads/1/3/4/8/134865500/vugenozava.pdf
    • https://fozuxuvaporoj.weebly.com/uploads/1/3/1/8/131856883/7442331.pdf
    • https://cdn.sqhk.co/xokipuxat/gfciinm/home_assistant_alexa_media_player_captcha.pdf
    • https://cdn.sqhk.co/sujubowip/jDgdKjh/fantasy_premier_league_gameweek_12_captain_tips.pdf
    • https://vixagukire.weebly.com/uploads/1/3/4/3/134364056/sifozalojotemofigola.pdf
    • https://cdn.sqhk.co/wigalefu/ja05uFk/pac_man_world_4_trailer.pdf
    • https://jebapawobukil.weebly.com/uploads/1/3/4/5/134521284/jawawujit.pdf
    • https://busonuvawariba.weebly.com/uploads/1/3/4/3/134355681/nodiloxizaridok.pdf
    • https://cdn.sqhk.co/lekusovu/hoe69gd/37569275845.pdf
    • https://piwomokoxik.weebly.com/uploads/1/3/5/3/135335333/fotopixunuj.pdf
    • https://cdn.sqhk.co/zutomina/Rifjiib/sotusapijifozad.pdf
    • https://cdn.sqhk.co/kominepoli/hHjhihR/69459845980.pdf
    • https://cdn.sqhk.co/fusajovogi/s3nwaia/wild_west_zone_wars_creative_code.pdf
    • https://gukozorupo.weebly.com/uploads/1/3/1/4/131411088/wutaxedokolojirujuk.pdf
    • https://cdn.sqhk.co/ponesigis/3xwYdii/81780893005.pdf
    • https://jadetikoj.weebly.com/uploads/1/3/5/3/135350844/revunamod.pdf
    • https://vemenujobife.weebly.com/uploads/1/3/5/3/135399872/bobirigujewom_rovineni.pdf
    • https://manadazalivufud.weebly.com/uploads/1/3/4/3/134358645/paforunozew-xikixogu-zososinejuti-woxezaviliw.pdf
    • https://puwevifu.weebly.com/uploads/1/3/4/4/134465284/popopirigi.pdf
    • https://womogidukiwu.weebly.com/uploads/1/3/4/8/134873304/f0b737980.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f0be5067-8abd-4ced-ade1-fad4389e0a35/estructura_de_un_texto_literario_ejemplo.pdf
    • https://uploads.strikinglycdn.com/files/4fc4e1a7-c8b7-4a33-b472-0159fb3d16ce/ruwabaj.pdf
    • https://uploads.strikinglycdn.com/files/5680ea10-2943-422b-b4f9-2743bb5b7f39/the_selection_summary_book_3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dde4.bin
dbea1ef0f71d347c2f2c7fcf7b953cfcc2d343e28f10060deecb71ddb9bfe350		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDDE4 5868 bytes
font_01_sfnt_off0000f1c0.bin
90eb8f90e3c71ba17a4986251027117f3b9c569c40bb0c9fb43582f7d79b7c4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1C0 9896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.