Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c93e7fb6a8957e4…

MALICIOUS

PDF

78.6 KB Created: 2021-03-06 06:17:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7775425748859562c3a2bf8861a61801 SHA-1: 5bce41f82f9ac8387bd9c2322addb33c81e8fe01 SHA-256: 7c93e7fb6a8957e46b75071b5cff61d145e61d7ce57bc54a968f1af1881dd93a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier with high confidence. It contains a large number of external links, suggesting a link farm or phishing attempt. The document body, though heavily obfuscated, appears to be related to gift guides, which is a common lure. The presence of embedded URLs and the overall structure strongly indicate malicious intent, likely to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=best+christmas+gift+for+teachers+2020
    • http://poroda.site/slow_motion_video_maker_app_apk_download01rxp.pdf
    • https://finazodaxuvoj.weebly.com/uploads/1/3/2/6/132682535/kizalide.pdf
    • https://kasasifu.weebly.com/uploads/1/3/4/6/134697732/fegojinu_vexozosiw_mulofirutofopor.pdf
    • https://kuxiwapanipajof.weebly.com/uploads/1/3/0/9/130969705/5406074.pdf
    • http://mx50off.pro/nostalgia_electrics_popcorn_maker_assembly_instructionsre2ox.pdf
    • http://fruitik.space/pegevixopaji9j5s6.pdf
    • http://byt-upak.ru/dt830_digital_multimeter_instructiong7qq9.pdf
    • http://netewe8.xyz/452842368015dzh4.pdf
    • https://nufewaxitobazat.weebly.com/uploads/1/3/4/7/134748461/vakedi.pdf
    • http://dasonudulikuvon.22web.org/how_to_activate_rca_voyager_3_tablet.pdf
    • https://bopidojosonek.weebly.com/uploads/1/3/1/3/131384153/fowona-kuvuzo.pdf
    • https://pevusipifo.weebly.com/uploads/1/3/4/8/134863194/senusupuzupilo.pdf
    • https://vuxupiwiruxip.weebly.com/uploads/1/3/0/9/130969000/suzubo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ba30dffa-51fe-4caa-9472-6f142403a9bb.filesusr.com/ugd/c2007e_2d0c1d427ce94022b30a2779e155d023.pdf?index=true
    • https://ec08fec6-e576-400d-8504-372613838d3c.filesusr.com/ugd/57e0ce_7e4d809a6e0a481c9c9e31aeebb7c80e.pdf?index=true
    • http://kobuxeniduf.rf.gd/poxolodubakelaxujegawiji.pdf
    • http://noluduji.epizy.com/adventureland_full_movie_in_480p.pdf
    • https://964beff5-d24f-450a-94e2-fa7e9faef44a.filesusr.com/ugd/61158f_2411cc4672a7445ea88b4e74f2e7707f.pdf?index=true
    • http://sedilone.epizy.com/best_light_tension_classical_guitar_strings.pdf
    • http://pepojugatidi.epizy.com/antologias_de_cuentos_infantiles.pdf
    • https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_2f763094a47846fd8d740a784fbf2e40.pdf?index=true
    • http://tirixerunifadi.rf.gd/24858770395.pdf
    • http://nifibomagogov.rf.gd/mobogenie_pro_apk.pdf
    • https://1618b3f4-dcc0-4047-a816-eeb1cbe43c51.filesusr.com/ugd/a01749_39ca012fe6fc4026a58bf0132ddfa9b2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4b4.bin
7fae325c516dc32e8b1aa13bbf8c38d1643d6b1e6f1225ebe0e640df2b83727e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4B4 5588 bytes
font_01_sfnt_off00010790.bin
d6d1137e0a65af47a524503b9e5d2c85dc18dcb2c003fc65e826e05968e13bc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10790 11224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.