Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d0121ad20e4adcc…

MALICIOUS

PDF

77.4 KB Created: 2021-04-23 05:19:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 49c7962986adfedee219a436cdf2b232 SHA-1: 72d063aae8f8f3ac18c6148041784510fffecb91 SHA-256: 7d0121ad20e4adcc3a649372ff188c6377ca61c2244b4a68e5f3734a5982837b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to benign-looking documents, but one critical heuristic identified a link farm designed to appear as SEO content. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically a phishing or trojan threat. The embedded URL points to a suspicious domain, likely serving as a lure for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=spiritual+leadership+oswald+sanders+study+guide PDF link annotation
    • http://community-day.ru/comprendre_l_empire_alain_soral_gratuit6sl46.pdfIn PDF document text
    • http://balifruit.com/79665206537dzlq2.pdfIn PDF document text
    • https://cdn.sqhk.co/seruribemoju/2khjiaN/emoji_stickers_for_whatsapp_wastickerapps.pdfIn PDF document text
    • https://kalujobad.weebly.com/uploads/1/3/4/3/134390175/4754598.pdfIn PDF document text
    • https://direwuberegenis.weebly.com/uploads/1/3/4/3/134361890/ripivot.pdfIn PDF document text
    • https://sulagumafiwez.weebly.com/uploads/1/3/1/3/131383207/gimurom_nifazuvut_nowenabuxoten.pdfIn PDF document text
    • http://wbigs.space/waruwogixnaji6.pdfIn PDF document text
    • http://vidclips.design/the_prayer_of_jabez_book_amazonvk50i.pdfIn PDF document text
    • https://cdn.sqhk.co/wepurodapike/fOmmYgz/flower_gardens_hammerhead_diving.pdfIn PDF document text
    • https://zuxolizaf.weebly.com/uploads/1/3/2/7/132740519/ba90dce.pdfIn PDF document text
    • http://cinurl.com/15lfxbIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lunojol/alfred_adler_indir.pdfIn PDF document text
    • https://s3.amazonaws.com/rekorewexidiwo/minecraft_furniture_mod_crafting_guide.pdfIn PDF document text
    • https://99f4a897-b223-4833-863a-50ad465ba5d5.filesusr.com/ugd/8e2371_eeb5d2da612b42e484d39cdee1fdb782.pdf?index=trueIn PDF document text
    • https://91c7bc9f-df77-4dbd-ae51-8bcf521f3e61.filesusr.com/ugd/1df9ea_8b4a4e617f3e4c74be5c357f6d49ca42.pdf?index=trueIn PDF document text
    • https://7e6b698e-d56f-4a21-8c48-787e2f6d39f4.filesusr.com/ugd/7836c9_afdbf44fbcf243fb83f4c51cd55547ba.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nitatotol/stihl_bg_86_c-e_handheld_blower_best_price.pdfIn PDF document text
    • https://s3.amazonaws.com/rurosaveruk/everquest_bard_guide_classic.pdfIn PDF document text
    • https://94226b1b-8363-4ad6-a779-e61b7b16ff5b.filesusr.com/ugd/b3bc21_5d8ed80f36f0474c9f33212ead782e1a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sojebelevenex/82521214379.pdfIn PDF document text
    • https://a3abd3d7-f7e4-4b0c-86b7-ec358d8c805a.filesusr.com/ugd/97a3b3_74717d0346b14fe38acf546c0b0a893d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jenagubadopi/mizasupinakexobum.pdfIn PDF document text
    • https://s3.amazonaws.com/xulepiwa/black_boy_chapter_13.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eeba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEBA 5520 bytes
SHA-256: 18fe01a58167692c281c32bef08f5f5a617f11074b53721ab5dab2cd1ab01e8c
font_01_sfnt_off0001018b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1018B 11356 bytes
SHA-256: c935823a12469d6a5df1170f48c1a516fb629da0b0f05fb6e41f343c5c24f130

Open this report in the interactive analyzer, or submit your own file for analysis.