Malicious PDF — malware analysis report

Static analysis result for SHA-256 79a75aec5ce58051…

MALICIOUS

PDF

77.9 KB Created: 2020-12-25 18:24:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 94189640e9f156f2fab30b2d9dbf4503 SHA-1: eb7ffacefcb045df64d247d84ce1d4a0fea7655e SHA-256: 79a75aec5ce580515b8721bf65ff46fc15c8a5ca3863dd58a3eea35ab6fb88c2
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for link farms and phishing campaigns. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded links suggest it's designed to redirect users to potentially malicious sites, possibly for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=direct+proportion+vs+inverse+proportion PDF link annotation
    • https://cdn.sqhk.co/xotabuti/iBgeihW/kidalawanadalebajipiti.pdfIn PDF document text
    • https://cdn.sqhk.co/linerutinew/lijihiA/we_happy_restaurant_mod_apk_2._5._10.pdfIn PDF document text
    • https://nepejudakolop.weebly.com/uploads/1/3/4/8/134876169/27983.pdfIn PDF document text
    • https://cdn.sqhk.co/wogigixa/hbHiehe/jubawow.pdfIn PDF document text
    • https://remitibomuko.weebly.com/uploads/1/3/4/8/134853657/vumurosigidufa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457582/normal_5fd67c47af27c.pdfIn PDF document text
    • https://cdn.sqhk.co/lilanoto/pQMvhjm/amazon_kindle_store_not_working.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/1ff1791d-b108-41ec-9eb5-b00700f370db/download_showbox_apk_for_iphone_8.pdfIn PDF document text
    • https://s3.amazonaws.com/juvosi/luvagazikogizin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca9182df-7933-4a66-96b5-0ab17394134b/21041609675.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4de868e6-e64c-4b03-9e2c-c19dadc80145/59859245464.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/051e6adf-2f59-46be-9234-0f8b5514415f/safajone.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC8C 4532 bytes
SHA-256: 4d9b018c6d3f18f1dece29b792b2443bb013f600a959c4b0e769b4c38e9d7c9b
font_01_sfnt_off0000dc03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC03 12324 bytes
SHA-256: 8a8b818e76102b54bf9359657a70d5dc80f3d01730de97188b8c26b4a462ad48
font_02_sfnt_off00010690.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10690 16348 bytes
SHA-256: 532011c8951d020d1e5b32866728cea6b6e5b919fdc27301ad8994c372f1b50e
font_03_sfnt_off00011c54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C54 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.