Malicious PDF — malware analysis report

Static analysis result for SHA-256 745d034440b88a10…

MALICIOUS

PDF

83.5 KB Created: 2021-03-23 19:01:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: d848a6666e31bca1c94276a173aac923 SHA-1: 25f02744d22c8dbb04190c4891f8b4b9d7f90fae SHA-256: 745d034440b88a100e61cfaec32010c79540cd7b1ffdf7dc3b9083b50fa27d52
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-themed, suggesting a link farm or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and numerous external URIs point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=harry+potter+movies+list+in+order+1-8+in+hindi PDF link annotation
    • https://cdn.sqhk.co/waxixojapu/jjjhhhb/22392292299.pdfIn PDF document text
    • https://cdn.sqhk.co/budafitanu/jfihDgd/oceanhorn_2_pc_requirements.pdfIn PDF document text
    • http://pevojatinolotej.22web.org/attractive_man_conversation_cheat_sheet.pdfIn PDF document text
    • https://cdn.sqhk.co/danuzenanini/UbdCdgi/liwejizetiwu.pdfIn PDF document text
    • https://xivanolub.weebly.com/uploads/1/3/1/3/131380121/6423c756e93c8.pdfIn PDF document text
    • https://cdn.sqhk.co/torevebeti/idei6ic/refixirewakot.pdfIn PDF document text
    • https://cdn.sqhk.co/suwezuzifu/ggIiesQ/61365117494.pdfIn PDF document text
    • https://lufuneliza.weebly.com/uploads/1/3/2/6/132682735/d3c2880a48261f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vanatul/suzuki_bandit_400_repair_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/numunenoji/shimano_canada_dealer_login.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/android_os_draining_battery_s6_edge.pdfIn PDF document text
    • https://00407fa8-a9ef-4b78-9bbe-46147fc8acf6.filesusr.com/ugd/5ecadc_fe09e057b91141a29b5b7fb755e04bd7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kelukakeb/baby_girl_names_starting_with_m_unique_punjabi.pdfIn PDF document text
    • http://valogaberel.rf.gd/pseudomonas_biochemical_test.pdfIn PDF document text
    • http://vogizopenukese.epizy.com/aircrack-_ng_wordlist_wpa.pdfIn PDF document text
    • http://baxuset.rf.gd/how_to_not_show_the_formula_in_excel.pdfIn PDF document text
    • https://24218389-b518-4ca3-8548-65eaf758daa4.filesusr.com/ugd/c836c3_10c5d467969e4ac983e4011ca066df62.pdf?index=trueIn PDF document text
    • http://biwodonugawodil.rf.gd/legend_of_zelda_link_between_worlds_guide.pdfIn PDF document text
    • https://fb413987-6e77-4bf1-aaa6-e97eb550fbee.filesusr.com/ugd/108936_8c5b428c04174de99936fa93cf81e405.pdf?index=trueIn PDF document text
    • http://sosumanaxixit.epizy.com/bringing_out_the_best_in_yourself_at_work.pdfIn PDF document text
    • http://tatevujes.epizy.com/long_way_down_lyrics_goo_goo_dolls.pdfIn PDF document text
    • https://1ebfeea1-7d02-43b8-8f0a-002c87bc7f75.filesusr.com/ugd/50dcf6_cc6a7e68d2c34887893f600354124aca.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010829.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10829 5600 bytes
SHA-256: 379e17b950b1371c7f6dc7b89798bd13d611a3f7613ed416fcbf01d78281f7f1
font_01_sfnt_off00011b1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B1A 10920 bytes
SHA-256: c5d2e0fc7a2b8407afbb8e50aba03a9aa161d0064a8a7220a89edc2e303141e6

Open this report in the interactive analyzer, or submit your own file for analysis.