Malicious PDF — malware analysis report

Static analysis result for SHA-256 8615e7aa06b6c3be…

MALICIOUS

PDF

91.6 KB Created: 2021-04-07 14:57:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 22cbd921ce8ff5567d44cd81410ca408 SHA-1: 759f0570754643eceaaded9c13674724a257c433 SHA-256: 8615e7aa06b6c3be2ce46a8768760fb7e3b010282592f8340dbcdae69996e6d0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, many of which point to suspicious domains, suggesting a link farm or redirection scheme. The document body, though heavily obfuscated, appears to be a lure related to TOEFL preparation materials, which is a common tactic for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=cambridge+preparation+for+the+toefl+test+book+with+online+practice+tests+free+pdf
    • https://wuxorazaw.weebly.com/uploads/1/3/2/7/132712222/dizutuludokadusogor.pdf
    • https://cdn.sqhk.co/tinupolureg/JiiDZhh/sherwin_williams_passive_color_strip.pdf
    • https://sosalikibagog.weebly.com/uploads/1/3/4/8/134856993/37f2d285918.pdf
    • http://idealslimitaly-official.site/110500947587spak.pdf
    • http://paganel.world/brooke_shields_pornjmgfk.pdf
    • https://jafipununevov.weebly.com/uploads/1/3/0/8/130814040/fotopigonobowofed.pdf
    • http://trackengine.host/bajujusafewerifrzhi.pdf
    • https://cdn.sqhk.co/lexuxeza/VmHklha/59172481936.pdf
    • http://hotloveme.online/echo_and_narcissus_myth_storyetvcr.pdf
    • http://ejinaya.com/the_seven_sins_of_memory_by_daniel_l._schactereftvo.pdf
    • https://cdn.sqhk.co/muvotugi/gIzEvvf/7933436007.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://058da8ce-bb30-4b8c-81eb-8903018cac65.filesusr.com/ugd/ab745b_b83c117dc6a041c4ba4166b262742aa0.pdf?index=true
    • https://564fd4a8-0e6d-4f97-813a-a14a70c45316.filesusr.com/ugd/f90d28_f2ea7a39f6634696b230282513e55922.pdf?index=true
    • https://03234a85-d811-4a68-a1f9-f7315bf9ccb2.filesusr.com/ugd/079591_18fc2eec5bb849669dfb7545677cee04.pdf?index=true
    • https://711a90e7-97f2-4eab-8690-3003ec1e9b64.filesusr.com/ugd/a0905b_e05af6adfdb8452ebcff44fb313bd676.pdf?index=true
    • https://9e1e9198-0fe7-4103-8084-fdcc6befb8d5.filesusr.com/ugd/2f7815_a75282ce755f4e0eae26ebb838b5fbfb.pdf?index=true
    • https://1de4b56a-3309-4767-83a2-f1bb1ea7c594.filesusr.com/ugd/a6e5e9_8e720ba45428493691077017cbf23208.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011db0.bin
cf64ef0c05565ed59242c5afbaea6272747860e94d3d6bfa9e571c0faca421cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DB0 5768 bytes
font_01_sfnt_off00013130.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13130 1800 bytes
font_02_sfnt_off000139bd.bin
0a0cf467a66d3179f9b1d13491c643b4258681d0ed1729a6dc06ece59dc35f17		 pdf-font-stream PDF embedded font (sfnt) at offset 0x139BD 11280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.