Malicious PDF — malware analysis report

Static analysis result for SHA-256 750685d9a9cd4445…

MALICIOUS

PDF

73.8 KB Created: 2021-03-17 13:05:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 24bd7f69ae982429848e44d530f515ff SHA-1: 1c8aaaf99dcd92840d1c7f30dd39d7d8d5c80bcf SHA-256: 750685d9a9cd4445bee640cd2018296ecf283d14f65497a53214f4be1ddedd19
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which point to suspicious domains and are likely part of a link farm designed to distribute malware. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or malware distribution. The presence of a download button lure further supports this. No scripts were extracted, but the overall structure and URL findings point to a malicious PDF designed to trick users into downloading further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=android+pie+beta+apk+download
    • https://cdn-cms.f-static.net/uploads/4484107/normal_603edadf84c16.pdf
    • http://xxlmature.site/hacking_game_app_android2vvt4.pdf
    • http://zoomita.space/21857529156ga8mz.pdf
    • http://xevusezes.medianewsonline.com/how_to_charge_my_fitbit_flex_2.pdf
    • https://cdn-cms.f-static.net/uploads/4493209/normal_602bef6d6539f.pdf
    • https://cdn-cms.f-static.net/uploads/4469116/normal_60128706d6576.pdf
    • http://gakawisogafuga.mygamesonline.org/business_trip_report.pdf
    • http://tujemet.scienceontheweb.net/93586842910.pdf
    • https://cdn-cms.f-static.net/uploads/4447101/normal_603af84e4e52b.pdf
    • http://punejew.mygamesonline.org/how_does_drinkwell_pet_fountain_work.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ef5f079d-1a84-41e6-a26d-ab839323e8eb/43338564546.pdf
    • http://novogizeboje.myartsonline.com/remington_11-87_semi_auto_shotgun_reviews.pdf
    • https://uploads.strikinglycdn.com/files/a5a62f18-5ba7-436b-bdba-78d6800d1e6d/how_do_i_get_veteran_on_my_texas_drivers_license.pdf
    • https://0f8fedcd-12c0-4678-86f8-e2bff7269121.filesusr.com/ugd/70e7d4_41375c3db6fb498d9dcb715de366d44d.pdf?index=true
    • https://d7179dab-c972-4501-9f4a-16044ca71e84.filesusr.com/ugd/434f74_c8acb3c7ee364e28b5a063798bdf1110.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0d6ad051-2258-4049-b763-c513e1e3bd74/skyrim_how_to_improve_enchanted_weapons.pdf
    • https://uploads.strikinglycdn.com/files/02c79ca2-bb59-4cec-8538-641a13a62d2b/craftsman_1_2_hp_garage_door_opener_trouble_codes.pdf
    • https://uploads.strikinglycdn.com/files/a7755d21-27d9-4b0e-ab04-92086f406edd/4_elements_of_film_style.pdf
    • https://3edbbcf3-b5b1-446e-9630-835d38fa79e0.filesusr.com/ugd/6908d7_b1502f423c2f42a1a01a7e434de9bf9e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/13093cb9-ec7f-4cb9-a689-98abdd1eeef1/84259666067.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e37a.bin
8c7ffbe145519b6411cdfbb15156c7328d52ebc76f59d85ddf47fed20ce5fb10		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE37A 5060 bytes
font_01_sfnt_off0000f4ce.bin
de9d44bbf5d768d2e616a94703b0d4421271ccb8589a186445c8008ac35036d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4CE 11048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.