Malicious PDF — malware analysis report

Static analysis result for SHA-256 822f330c24029867…

MALICIOUS

PDF

116.1 KB Created: 2021-03-27 11:13:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 35cfef860349d7bca068f3f59dddade0 SHA-1: c895d2d24f9338f331f2e041edf8bc12963cffe7 SHA-256: 822f330c2402986766679b5b37b396bedbc69d0b0ea84bfc781df1203a185ba5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified as a link farm, suggesting an attempt to direct users to malicious sites. The presence of embedded URLs and the ClamAV detection as 'Pdf.Phishing.Trojan' further support a malicious intent. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9242

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=cyberpunk+2077+ps4+review+gamespot
    • http://lordtrans.ru/63899425220lyjhr.pdf
    • http://4338bacchus.com/little_fires_everywhere_book_2pdzu0.pdf
    • http://mefazezotaw.22web.org/night_sky_app_android_free.pdf
    • http://salet.store/nadefanotimuteniligepufugx0pvf.pdf
    • http://palitra-cveta.ru/65338657867cwc3v.pdf
    • https://rifubagozoj.weebly.com/uploads/1/3/2/6/132695416/mefefidagera.pdf
    • https://cdn-cms.f-static.net/uploads/4373987/normal_605eed59aba66.pdf
    • https://static.s123-cdn-static.com/uploads/4384167/normal_5ffece4805310.pdf
    • https://gokaletuwatuni.weebly.com/uploads/1/3/6/0/136098233/8739602.pdf
    • https://xifalazixaxidig.weebly.com/uploads/1/3/0/8/130874217/8596567.pdf
    • https://s3.amazonaws.com/jumedemimo/45733337097.pdf
    • https://s3.amazonaws.com/gosete/yamaha_rx-a1040_problems.pdf
    • https://s3.amazonaws.com/kukupunopedon/twilight_midnight_sun_audiobook_free.pdf
    • https://s3.amazonaws.com/tinezedu/texitatavorofamorigi.pdf
    • https://s3.amazonaws.com/towutoginadivu/environmental_impact_assessment_report_sample.pdf
    • https://s3.amazonaws.com/goveruduzewoxu/bissell_powerwash_pro_not_spraying_water.pdf
    • http://tedijafubivot.epizy.com/50666044201.pdf
    • https://s3.amazonaws.com/buwosevax/97687288992.pdf
    • http://gifimedirawi.epizy.com/how_to_pair_jvc_ha-en10bt.pdf
    • https://s3.amazonaws.com/jazuravazaguz/bourne_supremacy_movie_480p.pdf
    • http://madixosapajob.epizy.com/5th_grade_math_worksheets_with_answers.pdf
    • https://s3.amazonaws.com/xixonu/megirimu.pdf
    • http://kutijizon.epizy.com/idbi_net_banking_application_form_download.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001bbc7.bin
a203a57eca702ec9c01ffbd237a9589d2ce3f599eaac76fdf9c94436dc70537e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BBC7 4788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.