Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a919714e0340f8c…

MALICIOUS

PDF

74.6 KB Created: 2021-03-30 12:54:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0471a870d2f7f1e54c03c1adfac8369e SHA-1: 6b7177a8a7b770b217a3e9df688b10dafa61c594 SHA-256: 7a919714e0340f8c47c41520fd1b6d050d8c8ccaf31e93f43fe0695919694d4d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to potentially malicious domains, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs are indicative of a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=how+do+i+program+my+dish+remote+to+receiver+vip722k
    • https://julamukipupa.weebly.com/uploads/1/3/0/7/130739907/a7ed8c8beaa.pdf
    • http://tigukifi.getenjoyment.net/aprender_a_dibujar_manga.pdf
    • https://telabafulux.weebly.com/uploads/1/3/0/9/130969700/rajaxi-juxobejiwideril-tenufitini.pdf
    • http://dixunawizodel.iblogger.org/rbi_guidelines_for_collateral_free_loans.pdf
    • http://loduwij.scienceontheweb.net/algebra_ii_textbook_mcdougal_littell.pdf
    • https://togutugu.weebly.com/uploads/1/3/4/6/134617883/zoraxib-folew.pdf
    • http://masanakepatarar.iblogger.org/why_do_i_want_someone_to_hurt_me_emotionally.pdf
    • https://zidifupo.weebly.com/uploads/1/3/4/4/134475425/vatiw-pifelo-vujilagev-sezasijojed.pdf
    • http://xefawojuj.mygamesonline.org/affairscloud_2020.pdf
    • http://fuzubijixulux.mygamesonline.org/poultry_diseases_and_their_treatment_in_urdu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9657e0aa-9e07-4e72-af93-31a88f47551e/xagabe.pdf
    • https://uploads.strikinglycdn.com/files/da256be6-ffb3-444b-8e05-29dcad723bfd/24287049870.pdf
    • https://uploads.strikinglycdn.com/files/d08713d6-27bf-4489-b96c-4ff3e942747b/sub_zero_pro_48_glass_door_refrigerator_price.pdf
    • https://uploads.strikinglycdn.com/files/14a95b4d-1c3e-42be-bdc1-994041e830b8/62214087159.pdf
    • http://wabiredozu.rf.gd/how_to_use_spectranet_mifi.pdf
    • http://mavefigekote.rf.gd/fazazulado.pdf
    • https://uploads.strikinglycdn.com/files/0b414cda-4e0b-4e24-a300-62563c92d86a/dafawewewirikunepulukotol.pdf
    • https://uploads.strikinglycdn.com/files/88389319-3e8d-4c66-8869-3bb58f22b3fb/11108431352.pdf
    • https://22520ec4-2132-45a5-98b8-54db1b71d3ea.filesusr.com/ugd/b33b96_a37f6b9985de4f86a0ce4c87bb42192b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e7e0faf4-d14a-40bf-bb65-35234c290728/pasijatatotowir.pdf
    • https://3a00e800-a8eb-44ae-aafc-ae9aecab8e06.filesusr.com/ugd/1715bf_6dde46ab94bb446aa04917929773a0e4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/984e424a-fdd3-476c-a012-73be28c35b26/what_are_the_advantages_and_disadvantages_of_geothermal_energy_source.pdf
    • https://uploads.strikinglycdn.com/files/2269d03c-d119-40cb-acc8-e556e6c262aa/wagamigurepisin.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e54a.bin
1cac4bd2a3ec1cd493808cf38e96b27b3cfbfe8deaa4221ba5f71ce922212a0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE54A 5944 bytes
font_01_sfnt_off0000f984.bin
75d58bec67500345b375bedb0ae110304ce9e23271c8a65ba594bca90c1993dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF984 10160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.