Malicious PDF — malware analysis report

Static analysis result for SHA-256 816c00fc435f3618…

MALICIOUS

PDF

88.2 KB Created: 2021-03-23 05:49:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 994a32fcd22276bb890671f277547f70 SHA-1: d82c3a8ddb715d80c176cb03cb76ff77cae4e8cb SHA-256: 816c00fc435f3618a1982d1b4af8700f9aae45884f0689374fa2ff9a68cbdd79
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm designed to distribute malicious content or redirect users to phishing sites. The embedded URLs and the PDF structure strongly suggest an attempt to manipulate search engine results or distribute further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=is+the+american+justice+system+fair
    • https://zilakakazaxo.weebly.com/uploads/1/3/4/4/134442972/2265626.pdf
    • http://mmeueue.space/anne_carson_autobiography_of_redwy4cm.pdf
    • https://zezojafoxivofed.weebly.com/uploads/1/3/4/5/134528913/9369009aac.pdf
    • https://valojeruxul.weebly.com/uploads/1/3/4/6/134681631/rezazofelam.pdf
    • https://notefusiwedamap.weebly.com/uploads/1/3/4/8/134872173/gasila.pdf
    • https://pokifinib.weebly.com/uploads/1/3/4/0/134017941/4986067.pdf
    • http://kiwenalod.medianewsonline.com/can_python_be_used_for_data_analysis.pdf
    • https://cdn-cms.f-static.net/uploads/4460263/normal_6035dc3c9d908.pdf
    • https://cdn-cms.f-static.net/uploads/4450512/normal_601a7a3b032fd.pdf
    • https://static.s123-cdn-static.com/uploads/4369310/normal_5fe4f65f62cfd.pdf
    • http://ropisunofo.mygamesonline.org/71916006154.pdf
    • http://reduslim-italiaoficial.site/rokekegixivezonuctqaq.pdf
    • https://zegusuvi.weebly.com/uploads/1/3/4/7/134738546/22903b0.pdf
    • https://ragidogatekanex.weebly.com/uploads/1/3/4/3/134388076/1bf3533.pdf
    • https://tudaluvakagovax.weebly.com/uploads/1/3/4/6/134614365/piluwixutoli_tomes_loseno_bevojifeka.pdf
    • https://static.s123-cdn-static.com/uploads/4476140/normal_5feb20d916232.pdf
    • https://zujujogonawanuk.weebly.com/uploads/1/3/4/8/134879196/lajuxigatufagogeni.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/30b1d806-6b67-4bed-977d-0abe520fbdda/why_does_my_hp_printer_keep_saying_ink_system_failure.pdf
    • https://uploads.strikinglycdn.com/files/690d7025-76c4-451e-9609-e9691709311f/is_chamberlain_keypad_compatible_with_overhead_door.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107c9.bin
782fee395fb8532780e381e44190281ed35c451cc06ae635f1fe3e314b0df788		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107C9 5204 bytes
font_01_sfnt_off0001195f.bin
f990c46b21f7b8ccdf3019cf4398a64ee807f14f9702544b4fc0f8e41a4715ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1195F 10876 bytes
font_02_sfnt_off00013ec0.bin
2173a1880e9f774f759393e7d0d28dda91d04d8a3eae6bea41b822770b343b90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13EC0 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.