Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fa6348241b41e6c…

MALICIOUS

PDF

86.1 KB Created: 2021-03-23 00:40:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 35fe39c670fac4221359e46bbc1a1bbb SHA-1: ec24311aca41df36fa40b3751aaa17182213d9c1 SHA-256: 7fa6348241b41e6cecc64cce3345ec4d866feb4d1c14d64c0056b72c511b9c93
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting it is designed to redirect users to potentially malicious websites. ClamAV detection and ML classification further support its malicious nature. The embedded URLs are likely part of a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=where+can+i+take+my+old+clothes+for+cash PDF link annotation
    • https://cdn.sqhk.co/mowuseparap/bjeS2RO/rise_up_andra_day_lyrics_and_chords.pdfIn PDF document text
    • https://cdn.sqhk.co/posiraki/eaVV4ic/dipatam.pdfIn PDF document text
    • https://cdn.sqhk.co/vaxarogajib/icojexO/baverelepevukesa.pdfIn PDF document text
    • https://cdn.sqhk.co/livulopo/3Niijd3/cake_decorating_tips_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/tatidukigag/a4Ahiie/boeing_747_supertanker_fighting_california_fires.pdfIn PDF document text
    • https://cdn.sqhk.co/tefaxobaf/hchahi7/seven_codes_of_bushido.pdfIn PDF document text
    • https://cdn.sqhk.co/rerupovev/hAjhicR/android_7._1._2_auto_start_app.pdfIn PDF document text
    • https://cdn.sqhk.co/vadavenaw/WNS3Zjc/toolbox_murders_2004_blu_ray.pdfIn PDF document text
    • https://cdn.sqhk.co/togokitaz/dYds3ij/feisty_greek_norwood_phone_number.pdfIn PDF document text
    • https://cdn.sqhk.co/dodazija/LihxPhj/jegiwifajobuberewegus.pdfIn PDF document text
    • https://cdn.sqhk.co/vikoparif/jgghaid/gupujozud.pdfIn PDF document text
    • https://cdn.sqhk.co/nobixapo/0jhyieY/free_family_chat_app.pdfIn PDF document text
    • https://cdn.sqhk.co/xeloxilava/bKEcQsG/gelupatole.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_d167aec0ff1745be89fc9a026bbec1a8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a3267d4-21e1-4465-a20c-e25a1268fe33/grade_10_biology_textbook_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0b84f6e-700d-4b9d-bc27-c9b0299374c3/lonikuvuwibanexalo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e716a6d1-2b5b-4376-abb9-cf4e5c6ed973/telilepone.pdfIn PDF document text
    • https://6b52f5a6-db44-4d3e-8337-ab33c729cb13.filesusr.com/ugd/f4de5e_fa9736493a944a35862354a5dd3e594d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d359258-59b0-46d9-a39c-09cd64615622/93497345448.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b307319-56f1-4a75-9347-c69a04edcf7c/25690783197.pdfIn PDF document text
    • https://1ffb5d6c-d890-49e0-9b87-dc10fbfa49e2.filesusr.com/ugd/8bc2a6_04129236deda4c54a053e64a2c137e4e.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000113b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113B3 5440 bytes
SHA-256: 660280fa3a07ea56452793791c15f99d1cb766ce17c064d04808aa035cf5db90
font_01_sfnt_off0001261f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1261F 10948 bytes
SHA-256: c56e01e87a2afa2914d7db233bd66554b92f35bae6c1ae7c512bc9036d9bd802

Open this report in the interactive analyzer, or submit your own file for analysis.