Malicious PDF — malware analysis report

Static analysis result for SHA-256 79412bf809174198…

MALICIOUS

PDF

82.2 KB Created: 2021-02-15 01:53:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: 4c32973d2a440ae32947c30065c0b81c SHA-1: fcc1d5523fff5e6da68c195fb771777028db4a14 SHA-256: 79412bf809174198a8126f19a9b6912685f0d55ee66afc10fea7878f9822fc96
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO spam or phishing campaigns. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. While no scripts were directly extracted, the PDF structure and the presence of many external URIs suggest it's designed to redirect users to malicious sites, potentially for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=soclean+manual+clean PDF link annotation
    • http://gatorama.space/tejorigetoxofogekevuvoiu9oh.pdfIn PDF document text
    • https://popibixa.weebly.com/uploads/1/3/4/7/134745137/27c6b.pdfIn PDF document text
    • http://mastera-saydinga.ru/luxiverh253i.pdfIn PDF document text
    • https://kavejujutafen.weebly.com/uploads/1/3/6/0/136022690/gokutidizezepet.pdfIn PDF document text
    • http://aycotoro0.xyz/bofol7aaiz.pdfIn PDF document text
    • http://danetasasanow.iblogger.org/translating_algebraic_expressions_answers.pdfIn PDF document text
    • https://cdn.sqhk.co/genamudazunu/jjUjb6E/89183211099.pdfIn PDF document text
    • https://cdn.sqhk.co/zudoputasafe/djduiaX/46046776059.pdfIn PDF document text
    • https://fikosaxan.weebly.com/uploads/1/3/4/7/134753192/bovelo_xabolen.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4496586/normal_5fcba1a9c9f1c.pdfIn PDF document text
    • https://cdn.sqhk.co/vipikunowi/diRTjGe/swish_basketball_hoop_trampoline.pdfIn PDF document text
    • https://cdn.sqhk.co/foroboreb/dfKqdjT/wewajezivokejo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wogikokuzotaxa/87147621973.pdfIn PDF document text
    • https://s3.amazonaws.com/zomuzigo/59668346138.pdfIn PDF document text
    • https://s3.amazonaws.com/nademopor/bangladesh_comedy_hd_video.pdfIn PDF document text
    • https://s3.amazonaws.com/xefezesebusu/seromewewukobelatu.pdfIn PDF document text
    • http://tededuliwe.rf.gd/zekoge.pdfIn PDF document text
    • https://s3.amazonaws.com/palikuvexake/cambio_climatico_en_chile_2019.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3B6 4528 bytes
SHA-256: 5c1275d9dfe75d69eaa8da4cf889fd76c7eaa42d881ce7b5c6d1c0770f76a8d2
font_01_sfnt_off0000f2e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2E8 10844 bytes
SHA-256: 228d4e71f7c1b8d88fdde3b87639e3b1b0e4332bcfac65e67cb893be2062c359
font_02_sfnt_off000117ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117EF 16232 bytes
SHA-256: cc032a1d7efe9f52c63bdca4360dad9aff78fb14a47167d9e0089e6cc9416013
font_03_sfnt_off00012d0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D0A 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.