Malicious PDF — malware analysis report

Static analysis result for SHA-256 741d3bee9b8ce8e3…

MALICIOUS

PDF

76.9 KB Created: 2021-03-31 17:40:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 3e9c65b8ae67643b2e542193bebc489b SHA-1: ea72e7ba41d0cd40d8fee9bba174ec1375cb5b15 SHA-256: 741d3bee9b8ce8e301cf7a9ee679515e96298c6aa99c3e56503b6ee8ff569f61
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many of which point to potentially malicious or phishing sites, as indicated by the PDF_SEO_LINK_FARM heuristic and the ClamAV detection. The document's content, though garbled, suggests a lure related to educational topics for children, likely to disguise the malicious intent. The embedded URLs are the primary indicators of malicious activity, suggesting the document is part of a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=diferentes+formas+de+relieve+para+ni%25C3%25B1os PDF link annotation
    • https://cdn.sqhk.co/fopikudapom/Gjijfgj/53720330020.pdfIn PDF document text
    • https://cdn.sqhk.co/lixipadiwel/wF6gjU8/heli_100_game.pdfIn PDF document text
    • https://cdn.sqhk.co/buxifuludo/S1Jic2G/42319396263.pdfIn PDF document text
    • https://cdn.sqhk.co/xenojepezere/fkyyDjc/doctor_career_path_in_south_africa.pdfIn PDF document text
    • https://cdn.sqhk.co/bimolixumotu/3gjvL5b/cyberpunk_4k_wallpaper_for_pc.pdfIn PDF document text
    • https://cdn.sqhk.co/letopoto/ipZwLe5/in_a_row_4_2_4_crossword_clue.pdfIn PDF document text
    • https://cdn.sqhk.co/temirikuji/fSid1HW/nfl_news_today_espn.pdfIn PDF document text
    • https://cdn.sqhk.co/fiseguvugele/qZRysih/dc_comics_movies_release_dates.pdfIn PDF document text
    • https://cdn.sqhk.co/noperizapewo/g3Qage6/1994_harlem_globetrotters_basketball_team.pdfIn PDF document text
    • https://cdn.sqhk.co/kososojog/jj54qgf/490165696.pdfIn PDF document text
    • https://cdn.sqhk.co/bisuligiga/iciehkE/create_a_todo_list_in_react.pdfIn PDF document text
    • https://cdn.sqhk.co/kanedufopuma/J732djj/9110385030.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebdbb1cb-6499-4d41-8eaa-2fd4ea242b2c/harbor_breeze_ceiling_fan_light_bulb.pdfIn PDF document text
    • https://528a8416-53f4-4693-bcf0-540471887af1.filesusr.com/ugd/c3aa89_856e2d22e51b49af924d73662cfe600b.pdf?index=trueIn PDF document text
    • https://d73c234d-0e3d-497d-8108-d5659bace061.filesusr.com/ugd/58a813_9081974adb8e4025b4e848979721dc20.pdf?index=trueIn PDF document text
    • https://d064ede3-316f-4d13-8ec5-014b2136b3bd.filesusr.com/ugd/154db6_8a682769ddd44372a484a50a7cc7fb83.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/afea1fc6-ad68-4cd9-a07b-a49d60b19da9/safety_net_construction_use.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ab6263f-a1bb-4e8e-b64a-a993b09198e7/3d_earth_science_project.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fcb7cab3-89e1-49b3-a9b4-4e287955bc61/fapogenamusexurupipuvul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b87920f8-bdb9-467c-a8d3-1874eb91552d/lenovo_g50-45_wifi_driver_windows_10.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC00 5460 bytes
SHA-256: 5759dcf937b378017fd1b01b1dec3a067aa6a4743ce176148ab0de1b9e0d71a7
font_01_sfnt_off0000fe44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE44 11776 bytes
SHA-256: e3021cd42c52c9c9c5aa76272c7f5d056a8b00705c5e3b7ea12ceee358b08ccc

Open this report in the interactive analyzer, or submit your own file for analysis.