Malicious PDF — malware analysis report

Static analysis result for SHA-256 7de050f3c10b9357…

MALICIOUS

PDF

73.4 KB Created: 2021-02-24 12:01:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 6ead07f53d21b1609bc3d320a79352c8 SHA-1: 599d8f6356f552de56408b1c70972903d5e417d5 SHA-256: 7de050f3c10b93577eb41d593cde8138918fad92b93072ffebacd787281f6463
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting it's part of a link farm or SEO manipulation tactic to drive traffic to potentially malicious sites. The document body, though heavily obfuscated, suggests a lure related to 'apostolic church bylaws template'. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/aws?utm_term=apostolic+church+bylaws+template PDF link annotation
    • https://patewowuxafopon.weebly.com/uploads/1/3/4/5/134595548/bipitegaxa-runetipikubib.pdfIn PDF document text
    • https://satepiwe.weebly.com/uploads/1/3/5/3/135350267/midejan.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464874/normal_6006b60b8cf3f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366340/normal_5fc695ccd513c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481064/normal_5fdd76231ca42.pdfIn PDF document text
    • http://folutelegaraz.iblogger.org/what_is_multivariate_analysis_in_statistics.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367643/normal_5fd1b3822b059.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392218/normal_6014bd08535eb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/womirofop/element_40_inch_smart_tv_reviews.pdfIn PDF document text
    • https://s3.amazonaws.com/zifozujiwi/kronos_timesheet_vumc.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/chemistry_elements_table.pdfIn PDF document text
    • https://s3.amazonaws.com/fosagoba/zebuwazigoponakafiwefimiv.pdfIn PDF document text
    • http://lavodusepigixu.rf.gd/77993658663.pdfIn PDF document text
    • http://semevalidenod.rf.gd/what_happens_if_your_dog_accidentally_bites_you.pdfIn PDF document text
    • https://s3.amazonaws.com/kikunojulejuj/religious_definition_of_formalism.pdfIn PDF document text
    • https://s3.amazonaws.com/zoromexemuzid/kleppner_daniel_and_robert_j._kolenkow._an_introduction_to_mechanics.pdfIn PDF document text
    • http://zuvidetalenaras.epizy.com/bairi_kangana_video_song.pdfIn PDF document text
    • https://s3.amazonaws.com/tifuwuw/acapella_app_picplaypost_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/jidosatikim/64384922573.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e309.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE309 5496 bytes
SHA-256: 069c4a2c52c61b99fc8e89282eb7faefed767fdb987aa2227fcd38469cca1a13
font_01_sfnt_off0000f5a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5A6 10032 bytes
SHA-256: 53e4b39b4f23cfd7e7caebeb6fcae54bba352b69aea10ff44c14b246e813dc7a

Open this report in the interactive analyzer, or submit your own file for analysis.