Malicious PDF — malware analysis report

Static analysis result for SHA-256 738438371c7f0b7e…

MALICIOUS

PDF

71.5 KB Created: 2021-02-26 13:19:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 2fd54fc16741b9dbe0233ac7e7033dc6 SHA-1: feac1315a31150444452a881128bb955ad3115a4 SHA-256: 738438371c7f0b7ec9d5b07fadbe828bfc2456d8002b55b4f814ce128270bd24
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and ML classifiers as malicious, specifically as a phishing trojan. It contains a large number of external links, many of which point to other PDF files, suggesting a link farm or redirection mechanism. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic indicate an attempt to direct users to potentially malicious or deceptive content. While no scripts were explicitly extracted, the nature of the link farm and the phishing detection suggest an intent to lead users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wb?keyword=baofeng%20uv-5r%20ham%20radio%20banned PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4488133/normal_5ff9d37e9481e.pdfIn PDF document text
    • http://ompala.store/333224120108gkyz.pdfIn PDF document text
    • https://wovofonunubani.weebly.com/uploads/1/3/1/4/131408017/1203f585e8c.pdfIn PDF document text
    • http://roxopazin.iblogger.org/39572850379.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461245/normal_5fdf53e1505a2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369315/normal_5fc738d313ad5.pdfIn PDF document text
    • http://covidcapsule.world/fosuxozumivugazifegetiwu1k5lp.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4406241/normal_60077251c0ed8.pdfIn PDF document text
    • http://ita-talia.fun/exponent_simplification_worksheet8jr9q.pdfIn PDF document text
    • http://zonizubiro.getenjoyment.net/tuesday_with_morrie_movie_online_free.pdfIn PDF document text
    • http://flymoney.net/nuzodivonabidudivasiiwg6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://petojijoxura.onlinewebshop.net/best_novels_to_read_to_7_year_olds.pdfIn PDF document text
    • https://s3.amazonaws.com/purixifusipelid/39813984994.pdfIn PDF document text
    • https://s3.amazonaws.com/wapabefizosumi/ubuntu_iso_for_vmware.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d85e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD85E 5516 bytes
SHA-256: a8e66d104ebc9190a55ac2a73b223441c5bf87015ce20cc5a41f43d445dfe119
font_01_sfnt_off0000eb0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB0D 11288 bytes
SHA-256: 6ba2730d7cdf352494aa617e756c300eebc519c76ec86397c2fe262d1b148f47

Open this report in the interactive analyzer, or submit your own file for analysis.