Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cccb14a10ed151b…

MALICIOUS

PDF

67.6 KB Created: 2020-11-22 03:07:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 83d85b63f0235b187427e8bbebaff3c6 SHA-1: 7fbe9eadd9225d5e56916eebcfae16836f852683 SHA-256: 8cccb14a10ed151be86c93651b2fa8b0dc947c3ec4ff88da846c8d13cb06d9a5
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier indicate malicious intent, likely related to phishing or hosting further malicious content. No scripts were extracted, but the PDF structure itself is used to host numerous external URIs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8036

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=belgium+league+table+and+current+form PDF link annotation
    • https://saxibodusazo.weebly.com/uploads/1/3/0/7/130740440/c0f05c9c0a.pdfIn PDF document text
    • https://peninugeba.weebly.com/uploads/1/3/4/6/134666339/825924.pdfIn PDF document text
    • https://dusexitope.weebly.com/uploads/1/3/4/6/134646398/960b96b0e.pdfIn PDF document text
    • https://dopilefuma.weebly.com/uploads/1/3/4/7/134733068/76d55f61f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374371/normal_5f8d539918355.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367013/normal_5f876c3ed4f82.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445733/normal_5fadfa0124844.pdfIn PDF document text
    • https://jelirakiwovul.weebly.com/uploads/1/3/4/8/134867041/90d23b51e5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387036/normal_5f8d6139da6c7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rejiner/100_microfarad_capacitor_datasheet.pdfIn PDF document text
    • https://s3.amazonaws.com/litunux/new_malayalam_movie_parava_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/wogikokuzotaxa/duripatipetilidupofat.pdfIn PDF document text
    • https://s3.amazonaws.com/zunaduxa/53126636075.pdfIn PDF document text
    • https://s3.amazonaws.com/bodepova/chess_club_reno_nv.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA25 5352 bytes
SHA-256: c92ce99a8dbac8fe836131630c83fbcf69b3cfb609d2b63dfda9004f83ffb964
font_01_sfnt_off0000ec44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC44 10776 bytes
SHA-256: 00db217e097845ba023f353c5e42b0e3aa4b874ce8521812beeb4b7101c453a0

Open this report in the interactive analyzer, or submit your own file for analysis.