Malicious PDF — malware analysis report

Static analysis result for SHA-256 830b4da4fed721c0…

MALICIOUS

PDF

78.3 KB Created: 2021-03-06 19:15:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 1d6ea2cff2afd1df03c63f2efa55aa35 SHA-1: cda3663a189dfa60ae24cd15e2e407bdd6a10f77 SHA-256: 830b4da4fed721c00b440d30f4fb078ed2573550c97b1b077bad6355e99a58e1
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ML classification and ClamAV, as malicious and likely phishing-related. It contains numerous external links, many pointing to SEO-optimized redirectors like 'https://leonvi.ru/wix?keyword=hecate%2527s+importance+in+macbeth', which likely serve as a lure to phishing or malware download sites. The document body is heavily obfuscated, but the presence of external links and the PDF_SEO_LINK_FARM heuristic strongly suggest an attempt to drive traffic to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=hecate%2527s+importance+in+macbeth PDF link annotation
    • http://kersita.fun/mental_status_exam_appearance_and_behavior_exampless3llq.pdfIn PDF document text
    • http://snatural.space/487730499569ogm9.pdfIn PDF document text
    • http://retys.fun/radical_forgiveness_worksheet_instructionshdwc3.pdfIn PDF document text
    • http://fitokaps.xyz/logitech_extreme_3d_pro_joystick_user_manualj337g.pdfIn PDF document text
    • https://cdn.sqhk.co/moserusoba/lOhiVxZ/vikings_axe_iowa.pdfIn PDF document text
    • http://foyou.store/basketball_shooting_machine_gamez5ohj.pdfIn PDF document text
    • https://cdn.sqhk.co/kisasizaro/ibheeb0/mugib.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://720c7b34-a033-4bf0-83ea-6be17de98aa2.filesusr.com/ugd/03ef8e_c6fbb1762f4d48289d0b031e7372fd38.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bakoloj/working_bedwars_map.pdfIn PDF document text
    • https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_124d0a99d85d4016b922b011fb3885b7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fokapikow/12460699292.pdfIn PDF document text
    • https://s3.amazonaws.com/xokebore/92066975630.pdfIn PDF document text
    • https://8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com/ugd/b2ba6b_d73f3d15230546f58e5b73df7892a7d7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sifawekujiki/34961806237.pdfIn PDF document text
    • https://0621cc9e-6449-4e8a-a8bd-baee9ad62a2c.filesusr.com/ugd/affb4a_9c1fa73d9b4f4c1ca5e04ee9e49aa63b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/devuxuzejozam/ethyl_chloroformate_derivatization_gc-_ms.pdfIn PDF document text
    • https://27158da8-170d-48ca-a528-b8ced62fe517.filesusr.com/ugd/9fc8c3_ca794f3bb86a456aa0f49b0365144aa6.pdf?index=trueIn PDF document text
    • https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_3c3dc980365a443c94b5d20246be0187.pdf?index=trueIn PDF document text
    • https://5e1449e8-5ae4-4a15-bc7a-ee23795bc964.filesusr.com/ugd/3a34a5_0a565a37cd6f454a892b1304af76caa8.pdf?index=trueIn PDF document text
    • https://5e446c31-fcb6-4427-a178-91ee45bbff8b.filesusr.com/ugd/4e76b8_bd00d1d731bf4b78be9c19442b3a0c88.pdf?index=trueIn PDF document text
    • https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_efac704ad28f42b9a11fe228ef440a15.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e870.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE870 5064 bytes
SHA-256: 89183262d81dc60bdcc19e87a8096bd971889b96230f6f2b40c119577c5a4a2e
font_01_sfnt_off0000f95d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF95D 10680 bytes
SHA-256: 3656f6ba7e33e9eec2498367bcbc40dab26ac6c201cdf30db19599b25e45f54a
font_02_sfnt_off00011dbb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11DBB 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.