Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d428a5df55b90a3…

MALICIOUS

PDF

94.6 KB Created: 2021-03-17 23:11:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 41fa95611f72bb78518cae264e88d235 SHA-1: 7823a2624118d9d82b65812670ee09ae1a645701 SHA-256: 8d428a5df55b90a351a31b9abc0650029bc769c3d91aa8a766a6f37f8170f124
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a link farm, suggesting a malicious intent to redirect users. The ClamAV detection and ML classifier strongly indicate this is a phishing or malicious document. While no scripts were explicitly extracted, the PDF structure and numerous external URLs point towards an attempt to lead users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=resumen+de+la+divina+comedia+por+dante+alighieri
    • https://mofegagopabelem.weebly.com/uploads/1/3/1/4/131438130/6275825.pdf
    • https://static.s123-cdn-static.com/uploads/4383138/normal_5fc6c6f84bc54.pdf
    • https://kukibutojiw.weebly.com/uploads/1/3/0/7/130775835/dovakegegako_bopumijomibel_foker.pdf
    • https://sakotitalivuvu.weebly.com/uploads/1/3/4/8/134887700/wopimunurusasuzeloto.pdf
    • https://ruwatija.weebly.com/uploads/1/3/4/8/134846771/372e0ceef68e.pdf
    • https://cdn-cms.f-static.net/uploads/4384149/normal_5fe6b53bd7029.pdf
    • https://cdn-cms.f-static.net/uploads/4377935/normal_603bfb0f99b6b.pdf
    • https://logutidukikov.weebly.com/uploads/1/3/1/3/131380383/kazavilemikuzajomixe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ragidunu.rf.gd/segowedigej.pdf
    • https://9c789f27-b70c-4c9d-9e83-211ee8f99b38.filesusr.com/ugd/bdeb4c_b832e27bb4474a358c295cc169b151de.pdf?index=true
    • https://s3.amazonaws.com/tosego/que_es_la_biblia_y_los_evangelios_brainly.pdf
    • https://667b589a-70dd-4c78-a03f-47f6e9f07b1f.filesusr.com/ugd/db80c5_02c1b78351c1438399b4366cfe5413de.pdf?index=true
    • https://s3.amazonaws.com/tezude/92287694589.pdf
    • http://zenejifawulo.epizy.com/39521632248.pdf
    • https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_2e470b181be645d795fa35b3986e7b2a.pdf?index=true
    • https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_df670084e8ff428c91531d5f1fb7d73e.pdf?index=true
    • https://s3.amazonaws.com/wupiwupiwot/graco_nautilus_80_elite_expiration.pdf
    • https://s3.amazonaws.com/bomifabipi/audacity_with_crack_free.pdf
    • https://s3.amazonaws.com/dewazewokib/95005734484.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000129ef.bin
e68a932a4dc22f9cc4bb375359c52270731db1a0a74513ac2d13837d12889026		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129EF 5552 bytes
font_01_sfnt_off00013ca8.bin
d47ac0a93a8fe4d084baaa2358e4a07dfebe2e9428dce1e0e873f22777b06c9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13CA8 15080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.