Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b18e7a9c8b0ff6a…

MALICIOUS

PDF

93.0 KB Created: 2021-04-07 02:57:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: bac6b88f8ad8966c1261691349688b35 SHA-1: 26a53763fc1a99a7c7d24134d8331431187e352e SHA-256: 7b18e7a9c8b0ff6ad86d6abc13de61a57010f1b12cfddd8b9aa14b63cb498be1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to potentially malicious domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a phishing trojan. The embedded URLs likely serve to redirect users to phishing sites or download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=georgia+driving+permit+test PDF link annotation
    • http://bitjoms.xyz/what_happens_at_the_end_of_the_fifth_wavemypln.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482882/normal_603184b436d12.pdfIn PDF document text
    • http://rukozhop-guide.com/dialectical_journal_word_templatexm229.pdfIn PDF document text
    • http://hs-life.ru/fumerijopikolq589j.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424024/normal_60257a9b8f408.pdfIn PDF document text
    • http://firstflirts.site/local_calling_guide_com_lca_prefix_php2igte.pdfIn PDF document text
    • http://redit.fun/sutuvusuwexofipa20deg.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413363/normal_5fee82608d6f4.pdfIn PDF document text
    • http://icub.tech/catering_service_feedback_formoagdy.pdfIn PDF document text
    • http://remontnatali.ru/31707197351riv2w.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471082/normal_5ffec3ff58688.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://0f3c41ac-de96-4ba7-a517-026d7435d592.filesusr.com/ugd/8631de_ae6e4ea4883b4bf392c804067e9a8986.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/donake/zebig.pdfIn PDF document text
    • https://807eaacf-9fb6-4e16-bcb8-061395d1d132.filesusr.com/ugd/a3ef2e_3fb650a0ef984497bcd5ff8c213a535e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fojaxexino/bricks_breaker_puzzle_apk_indir.pdfIn PDF document text
    • https://db38eef3-7d65-43a4-badd-ba39ed7d9417.filesusr.com/ugd/bd2483_904539898a2a4eb588abdf2fd746e5a3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jeponowon/vazomij.pdfIn PDF document text
    • https://s3.amazonaws.com/pirosisob/what_are_good_basketball_names.pdfIn PDF document text
    • https://s3.amazonaws.com/tigovatolis/conference_program_templates_free.pdfIn PDF document text
    • https://bac325b5-3710-4a60-ba01-c1ac5e8a7650.filesusr.com/ugd/c111de_d336c5490718403ab041599687c98be2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pigolo/tamil_monthly_calendar.pdfIn PDF document text
    • https://s3.amazonaws.com/fulosobezur/honda_7000_watt_generator_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010af4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AF4 5128 bytes
SHA-256: 703bf6919a1acc319a66f58b7eb23a83e27ef87f994a2e70cb9f9e56522433b9
font_01_sfnt_off00011c52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C52 10236 bytes
SHA-256: 21647e1091acf1cc0026f8969ab5eb9784a9df2999901de5c0d8ec58496c821f
font_02_sfnt_off00013f9d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F9D 16940 bytes
SHA-256: 40d5965765d7f14b261bb6290f9b32d9becd084b3d8c0da0d83148ee670b356b
font_03_sfnt_off000157ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x157EF 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.