Malicious PDF — malware analysis report

Static analysis result for SHA-256 733d2c08ec41492b…

MALICIOUS

PDF

90.5 KB Created: 2021-03-27 17:31:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4e1246d7a9af6081b4849f0adef199c SHA-1: de78aee81dd50693ba0a579ee8537bedba5e5e83 SHA-256: 733d2c08ec41492b4275a9dca26fa87ea7bbc638c6e884ffad349a97741f8d72
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. The presence of a large number of external links suggests a link farm or phishing attempt. While no scripts were explicitly extracted, the PDF structure and external URI firings point towards a malicious document, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=michael+c+harvey+inventor
    • https://cdn-cms.f-static.net/uploads/4449392/normal_605473e2e00fb.pdf
    • https://gojufoviwovefu.weebly.com/uploads/1/3/4/5/134515133/2419358.pdf
    • https://cdn.sqhk.co/gorokipo/cBiaKib/answer_back_system_lexi_standard.pdf
    • https://static.s123-cdn-static.com/uploads/4421959/normal_5fe42ac4792ae.pdf
    • https://cdn-cms.f-static.net/uploads/4384650/normal_603c41d10039d.pdf
    • https://cdn-cms.f-static.net/uploads/4420911/normal_60515cdbd4d6e.pdf
    • https://cdn-cms.f-static.net/uploads/4365546/normal_604e7bda1e8e2.pdf
    • https://bowodazuludov.weebly.com/uploads/1/3/4/7/134700376/luwutu.pdf
    • https://cdn.sqhk.co/kulobibab/xieIghv/kuniduvogutipebomeb.pdf
    • https://static.s123-cdn-static.com/uploads/4419822/normal_60090eb425a95.pdf
    • https://vebuwume.weebly.com/uploads/1/3/5/3/135349689/sikevajivabov.pdf
    • https://static.s123-cdn-static.com/uploads/4386849/normal_5fcfe78da8b8d.pdf
    • https://gidiwukos.weebly.com/uploads/1/3/1/3/131381706/4896633.pdf
    • https://cdn.sqhk.co/tezofifevag/ijAjbgd/smart_balance_wheel_scooter_charger.pdf
    • https://betisifi.weebly.com/uploads/1/3/1/4/131438474/7a642f49.pdf
    • https://cdn.sqhk.co/nijusukelok/qjihegj/95891125984.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1437f3f1-f978-4e1b-9120-555090070881.filesusr.com/ugd/d4ef56_4268bb55853848aeb94d41d883d26e32.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fe8738a8-2ed4-4e18-b192-3b38f7969bc4/naxoxobusitewotolo.pdf
    • https://uploads.strikinglycdn.com/files/8a5c3b95-02a2-44f4-9dc2-9b0f5b579f6e/10909032605.pdf
    • https://uploads.strikinglycdn.com/files/12b61058-9031-4fbe-b6b2-d6756492bb7f/51517748551.pdf
    • https://uploads.strikinglycdn.com/files/9d7a0430-4895-42de-b4d7-e861edc03033/34148877493.pdf
    • https://21a67f6d-2aea-439f-a910-ed4feb6be009.filesusr.com/ugd/173616_543a434291514962bc10fdd9fe2b3e19.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000124a2.bin
7dc71f1d462e2c7acb7118f1d8a143742f3fe9cbe17f649a263e8ed633720202		 pdf-font-stream PDF embedded font (sfnt) at offset 0x124A2 4876 bytes
font_01_sfnt_off0001354b.bin
f8296b57032ea75497e5f642ad12c034dd191361989fddbeaf9ead14ff901246		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1354B 11624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.