Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a75a1e6b10f235e…

MALICIOUS

PDF

82.2 KB Created: 2021-05-11 02:32:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0e03bc4c089893d5ad941e07cfe61e05 SHA-1: c000f1993b95b8676c9496d0a64278310eca2196 SHA-256: 7a75a1e6b10f235e9564c3ef4063dbc3a76da089c1d61934a6d91a5ba0feb86f
216 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document uses a lure related to 'Wu tang collection full movie download' to entice users. It contains a large number of external links, many pointing to other PDFs, suggesting a link farm or redirection mechanism. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to distribute malware or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 7

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=wu+tang+collection+full+movie+download
    • http://ginixotojaru.medianewsonline.com/90711679711.pdf
    • http://bewewafip.scienceontheweb.net/sn_singh_basic_electrical_engineering_download.pdf
    • http://lemafesopeposuz.mywebcommunity.org/raperepatiranimukadote.pdf
    • http://tavafotuzefox.sportsontheweb.net/17716489587.pdf
    • http://bitoxifa.sportsontheweb.net/what_lexile_should_a_3rd_grader_have.pdf
    • http://xiguxivevov.sportsontheweb.net/arduino_uno_spec_sheet.pdf
    • https://cdn-cms.f-static.net/uploads/4490736/normal_6041675be03bb.pdf
    • https://cdn-cms.f-static.net/uploads/4448330/normal_604f6b9caf3ef.pdf
    • https://cdn-cms.f-static.net/uploads/4388279/normal_6010846c1c99e.pdf
    • http://lomilinixigal.mypressonline.com/list_of_statistical_software.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://d89d6b52-6e76-4e18-bccb-bd7428cfddad.filesusr.com/ugd/02beb7_adbbc7bc42c04f83b695f510d7376649.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ce8ee358-c8ad-40ed-b718-14f01b56daba/charles_bukowski_best_poetry_books.pdf
    • https://5090cb7a-f7dd-45b7-a4a3-960150b62b23.filesusr.com/ugd/dfd4af_1192f0a71bc444118df0d6886709956e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/dc8bd7b6-be2c-48e5-a7d8-dd502ace18fc/should_a_single_man_buy_a_house_reddit.pdf
    • https://uploads.strikinglycdn.com/files/01e0240f-c5bc-41a0-a50e-d5b6838ca338/how_many_carbs_in_a_firehouse_sub.pdf
    • http://fajazimigig.atwebpages.com/3716667158.pdf
    • https://uploads.strikinglycdn.com/files/f204474f-c257-41dc-8445-22702c7a8b96/3999384879.pdf
    • https://uploads.strikinglycdn.com/files/781ee3c3-406f-4df8-bf79-8995a4475086/2005_chevy_malibu_starter_problems.pdf
    • https://uploads.strikinglycdn.com/files/ecdfae50-6298-4bf3-b026-b1ea6ad1abea/journey_to_the_centre_of_the_earth_3d_blu_ray_review.pdf
    • https://dcc20dec-0195-4543-b617-cfb82efd15f0.filesusr.com/ugd/30ea26_ed5fa027ae2240a899b1eb18a364cdb2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1db4415d-662d-4456-871d-471a005b6960/semaxiwit.pdf
    • https://c8070bf9-ed42-4c5d-8eb8-ca35ee70f136.filesusr.com/ugd/d38238_f1c4f09509ec4c43afe3d3e2a82a0bcb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f444.bin
06937865d34725fd87f913930162243492e684396ecbb2d25e2c45ffaa11b536		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF444 3136 bytes
font_01_sfnt_off0000ff68.bin
32e1b4952d2fb814cb578d2a93ae653a7d49cf7860f10bcbba656ab54572cd95		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF68 5232 bytes
font_02_sfnt_off0001114c.bin
d1ad1aa5968168323e7f07897e497c02c8efbc6176598b0557157edf0e4701a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1114C 12188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.