Malicious PDF — malware analysis report

Static analysis result for SHA-256 798817b23a599a12…

MALICIOUS

PDF

80.9 KB Created: 2021-04-26 11:41:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5d927bc6dc26eada3fbe8a7e347b027a SHA-1: d4bee32b11d283caf469c2d65532c88924fdec76 SHA-256: 798817b23a599a122373f2b3e44e87e484a2cc8fb55b23f964da8b82e79095f9
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are part of a link farm, suggesting an attempt to manipulate search engine results or distribute content. The 'SE_CALLBACK_LURE' heuristic indicates the document is designed to trick users into calling a phone number, a common tactic in phishing and tech support scams. ClamAV also detected this file as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=how+do+i+unmute+my+ringer+on+my+vtech+cordless+phone
    • https://static.s123-cdn-static.com/uploads/4410418/normal_5fcf47c5d053e.pdf
    • https://sujugixuguxidi.weebly.com/uploads/1/3/4/6/134615921/vigakuwib.pdf
    • https://cdn-cms.f-static.net/uploads/4461505/normal_6046ba76d663c.pdf
    • https://static.s123-cdn-static.com/uploads/4460686/normal_5ffc82fdb9dc7.pdf
    • https://static.s123-cdn-static.com/uploads/4418781/normal_5ff22ab9a6acd.pdf
    • https://nelizozab.weebly.com/uploads/1/3/0/8/130874358/ragosugonuwig.pdf
    • https://dotanivim.weebly.com/uploads/1/3/4/7/134705276/5059855.pdf
    • https://tedibajibivo.weebly.com/uploads/1/3/1/4/131406927/3457679.pdf
    • https://jetasiduneka.weebly.com/uploads/1/3/4/5/134586997/kokidoga.pdf
    • https://static.s123-cdn-static.com/uploads/4384642/normal_6003d62f69d58.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://bcbc83ff-a82b-4234-bf1d-c69e8cae54d5.filesusr.com/ugd/057c82_d9048399e39a4225a4d01637b2c06cc4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/752b0dec-cc65-46fc-8eb1-76abd8f2dc26/mududipizorisanedofarut.pdf
    • http://tukaxowelu.rf.gd/ib_approaches_to_learning.pdf
    • http://puzasapexuwuju.epizy.com/elder_scrolls_online_bloodroot_forge_guide.pdf
    • https://uploads.strikinglycdn.com/files/c1550f6a-541d-4c3b-8fd9-7135bb0566fc/epson_artisan_810_price.pdf
    • https://uploads.strikinglycdn.com/files/3514c173-ef76-4df0-811d-fa11259dcadf/ps3_move_harry_potter_book_of_spells.pdf
    • http://jekalabol.epizy.com/candide_voltaire_resume.pdf
    • https://50c84cdf-c8d4-407e-a307-361b94491100.filesusr.com/ugd/f2656e_439d1653db294df98c8f0083d69064ed.pdf?index=true
    • https://c8f6a2ed-bc8a-4fd4-b26a-19707db7c4cd.filesusr.com/ugd/1cc7e8_9bdd8f1d73f14601a08663b382415473.pdf?index=true
    • https://ca30e0e0-ecf2-44ab-b6a2-fe26291458be.filesusr.com/ugd/34e21e_5c36e78d2a3843fa9fec1c0d2191799b.pdf?index=true
    • https://d78d2789-9aef-4bfd-88be-9093bec910ef.filesusr.com/ugd/87a178_4e38adae85d54508916067eb68d7174f.pdf?index=true
    • http://kazowaz.rf.gd/xuludopumajafadowuxom.pdf
    • http://gevasonajudot.epizy.com/how_to_use_my_casio_fx-9750gii.pdf
    • https://uploads.strikinglycdn.com/files/fe5f4a0f-89f8-401a-9c83-ba414ecd70f5/yard_machine_riding_mower_repair_shops_near_me.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f00b.bin
5da3ed27af4addb4d2b5f219821442de8995e40f2031e6808d3a26fe962b6b55		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF00B 5372 bytes
font_01_sfnt_off00010244.bin
1972765d3108472a9387babdc1802184396f383b2f54e516c19fc5aac3191c80		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10244 10888 bytes
font_02_sfnt_off00012748.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12748 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.