Malicious PDF — malware analysis report

Static analysis result for SHA-256 783da141beda6cf9…

MALICIOUS

PDF

81.3 KB Created: 2021-03-22 20:13:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3f4d178c370cbb75188a6181493c3b29 SHA-1: d1ad6a4dbe267003729b039577790e212cdc295b SHA-256: 783da141beda6cf95e5721cb5fc0c5c1774f4cb9f97962b25a985906711ce52a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. The document body, though partially corrupted, suggests a lure related to 'English grammar questions and answers pdf download'. The presence of numerous external links, including a link farm heuristic, strongly suggests the document is designed to redirect users to malicious websites. No scripts were extracted, but the PDF structure and heuristics point towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=english+grammar+questions+and+answers+pdf+download
    • https://jadamoxor.weebly.com/uploads/1/3/5/3/135344742/1192051.pdf
    • https://cdn.sqhk.co/wuseguwe/giiji4V/gipifomezoguminubirefazuw.pdf
    • https://cdn-cms.f-static.net/uploads/4475719/normal_605448afb268e.pdf
    • https://cdn.sqhk.co/mujawiru/hYifgid/stickman_escape_lift_think_out_of_the_box.pdf
    • https://jajaleregonu.weebly.com/uploads/1/3/4/2/134235513/databiwitodawogudix.pdf
    • https://cdn.sqhk.co/ramazunor/VLhjmCI/atif_aslam_pachtaoge_video_song.pdf
    • https://cdn-cms.f-static.net/uploads/4388428/normal_60463d65d4192.pdf
    • https://ridegagix.weebly.com/uploads/1/3/4/6/134668883/7ffbbcfcb79976.pdf
    • https://cdn.sqhk.co/dopuwene/hKqifgh/escape_evacuate_synonym.pdf
    • https://cdn.sqhk.co/wifinalimow/lgdRgcs/shogun_express_menu_prices.pdf
    • https://cdn.sqhk.co/fegibowaxus/cOejhhq/jafadelibekowidizu.pdf
    • https://cdn-cms.f-static.net/uploads/4420906/normal_603e86c621981.pdf
    • https://cdn-cms.f-static.net/uploads/4500183/normal_601243b989905.pdf
    • https://fugokepak.weebly.com/uploads/1/3/4/8/134856046/4dc9ba505329.pdf
    • https://cdn-cms.f-static.net/uploads/4445341/normal_603194f5cc399.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/penale/acid_base_reactions_titration_curve_worksheet_answers.pdf
    • https://uploads.strikinglycdn.com/files/c4bc0eb6-3891-42f3-94aa-54823cfc4611/2004_dodge_ram_1500_hemi_towing_capacity.pdf
    • https://s3.amazonaws.com/samopakamefap/miller_heiman_blue_sheet.pdf
    • https://s3.amazonaws.com/batoragubukepo/guvaliwatejupazi.pdf
    • https://s3.amazonaws.com/woxewiwupir/apogamous_sporophyte_formed_in_ferns_are.pdf
    • https://uploads.strikinglycdn.com/files/40f88a87-e889-4034-a718-9283d3b8a726/what_does_the_3_heart_emoji_mean.pdf
    • https://s3.amazonaws.com/rizezobabub/91795823634.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fca4.bin
3cd352f991fe02a2694becaba1d3e2f2ab875cb600edf14ab446d45587ca2b55		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCA4 5632 bytes
font_01_sfnt_off00010fae.bin
aec800311d0f4e5d05ac84ba2827e4262732d0e9b5df93ea447f7b55b55dcd05		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FAE 11020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.