Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b4780c2463b5caa…

MALICIOUS

PDF

78.4 KB Created: 2021-03-10 15:57:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 39584bf6d1198bb8777398ea2c61ac8d SHA-1: c6c6db30730dbc5e30c9db739edf197f3012e296 SHA-256: 8b4780c2463b5caa1c8df480ea084c5ee59f004b34c5b2ba2fb87162419a158b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a PDF SEO link farm. The document body, though heavily obfuscated, suggests a lure related to 'Florida self certification cdl form'. The presence of external URIs and the ML classifier output strongly indicate malicious intent, likely for phishing or distributing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=florida+self+certification+cdl+form PDF link annotation
    • https://posesisex.weebly.com/uploads/1/3/5/3/135332701/kovixirakememeje.pdfIn PDF document text
    • http://wudenufodoroziv.scienceontheweb.net/how_to_use_weight_watchers_point_plus_calculator.pdfIn PDF document text
    • http://vurejowug.mypressonline.com/how_many_languages_are_spoken_in_nepal_in_number.pdfIn PDF document text
    • http://jorowijedo.mywebcommunity.org/vapefutipax.pdfIn PDF document text
    • http://dufifudusimube.mygamesonline.org/frases_celebres_de_la_novela_el_amor_en_los_tiempos_del_colera.pdfIn PDF document text
    • http://kutatit.getenjoyment.net/pagaxirusupuzazisulidi.pdfIn PDF document text
    • http://misujupino.getenjoyment.net/rrb_ntpc_notification_2020_sarkari_result.pdfIn PDF document text
    • http://zadamenabup.22web.org/sukisewu.pdfIn PDF document text
    • https://pulavirovedozas.weebly.com/uploads/1/3/2/6/132695401/bejadadaban-gaxomexotamab-dizazas.pdfIn PDF document text
    • http://medakijizu.22web.org/rezowo.pdfIn PDF document text
    • http://boketizabujig.scienceontheweb.net/82505798338.pdfIn PDF document text
    • https://felunazajejo.weebly.com/uploads/1/3/5/9/135959991/sejonu-gujibamol.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kojenixerog.myartsonline.com/do_you_still_get_paid_for_leave_of_absence.pdfIn PDF document text
    • https://s3.amazonaws.com/juvetaso/42426188490.pdfIn PDF document text
    • https://s3.amazonaws.com/wujapu/chitralahari_lyrics_video_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/mubemutolewe/90139069718.pdfIn PDF document text
    • http://dowijasimenazo.epizy.com/most_readily_absorbed_form_of_magnesium.pdfIn PDF document text
    • https://s3.amazonaws.com/fumiposamisur/45110757648.pdfIn PDF document text
    • https://s3.amazonaws.com/rurovikejigibu/file_police_report_san_francisco.pdfIn PDF document text
    • https://s3.amazonaws.com/rodigapigeta/ashp_poster_presentation_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/defujo/shadowgun_legends_blade_dancer_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec64.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC64 1796 bytes
SHA-256: 4691d41b4e497c92ed9d3d701dafd0417415279d847973f4500f4018b960e1d1
font_01_sfnt_off0000f525.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF525 5124 bytes
SHA-256: 65b0673e4043050caf373fb03d1b4f7383f894fa657d9e15ea64c2d39623db1c
font_02_sfnt_off0001067b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1067B 11008 bytes
SHA-256: 41335222437aefef63c138f1b825067e635121f59f9f73dc2ec40811287f18c6

Open this report in the interactive analyzer, or submit your own file for analysis.