Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f0ce493671ed940…

MALICIOUS

PDF

76.9 KB Created: 2021-03-08 21:56:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: cc108a45a715b64095e545e9aadf7d04 SHA-1: f5d5abd6600699219f33f4ee9123828766554bfd SHA-256: 8f0ce493671ed9402a5a1b4a668ec70637cc3b1ca703610d3dfe92e3a6cba563
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are to PDF documents, suggesting a link farm or SEO spamming tactic. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The presence of embedded URLs and a 'download button' heuristic further supports a lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=bteup+marksheet+2015 PDF link annotation
    • http://usblighter24.site/2nd_grade_books_cheap0x4am.pdfIn PDF document text
    • https://cdn.sqhk.co/wudawagirus/4haTABE/fizuvev.pdfIn PDF document text
    • http://martakkord.ru/bebawolw4pcg.pdfIn PDF document text
    • https://cdn.sqhk.co/wagejino/jijgigC/expedition_lands_zendikar_rising_price_list.pdfIn PDF document text
    • http://housefashion.ru/124071788185dvym.pdfIn PDF document text
    • http://zahlungsservice-ch.site/never_enough_sheet_music_transposed378dv.pdfIn PDF document text
    • https://cdn.sqhk.co/lizuloka/1xFhfjj/3d_archers_oldenburg.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://9f5bcc56-a059-4f00-ae85-604acd6a3d2d.filesusr.com/ugd/ac9354_925af82e36cf437c8baa97f57c57aa48.pdf?index=trueIn PDF document text
    • https://36fc1fe3-b646-4cc1-b6e9-de51469aea27.filesusr.com/ugd/3eb4bd_c5993821ace340349629efed8bdb0c72.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tobito/ielts_reading_test_with_answers_2019.pdfIn PDF document text
    • https://9e730ba1-499c-413e-9a09-8a81f8121270.filesusr.com/ugd/0a0016_a4c87deb1ac248d694b7cb0606704bbe.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nedijowewoded/the_pact_isaac.pdfIn PDF document text
    • https://s3.amazonaws.com/bipovoromoj/ventless_washer_dryer_combo_canada.pdfIn PDF document text
    • https://02e0da19-eac5-4521-950b-4e410541bf1c.filesusr.com/ugd/516249_6b5591b7f239441b944493c17cb02be3.pdf?index=trueIn PDF document text
    • https://050a9d39-d8a1-4107-8be8-b2b70b72e454.filesusr.com/ugd/5262df_fdc93a8b2d15490cac3d37756bc81ce0.pdf?index=trueIn PDF document text
    • https://469ee322-798e-4c1d-9571-af6764901f97.filesusr.com/ugd/57169b_47a050af82ad4c949873b260ef7336d6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zerepuzuze/can_i_watch_la_la_land_on_netflix.pdfIn PDF document text
    • https://s3.amazonaws.com/xasovewipeje/fact_or_opinion_worksheets_for_grade_2.pdfIn PDF document text
    • https://s3.amazonaws.com/lorifawuvawot/40039083611.pdfIn PDF document text
    • https://7f06b679-e14d-4525-8955-d56a7cf6f710.filesusr.com/ugd/79e5df_dfa3558d7f12445b9a17a799082974ee.pdf?index=trueIn PDF document text
    • https://979cd01f-16ea-4d2c-b189-234964c95597.filesusr.com/ugd/d4c4cf_880b6ad2c5a64badab503ae32f511023.pdf?index=trueIn PDF document text
    • https://71f68c9c-1037-483c-a0ca-f268b7ddd3c8.filesusr.com/ugd/87fdc7_9ea504ac2e744aec96cd07b699241d58.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wulagisi/fexilisomar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE92 5588 bytes
SHA-256: fdf361e2af66e562ddad704aab5d18aa69d3eaa2844e9cc9b5f2b7d3578984c3
font_01_sfnt_off0001016f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1016F 10700 bytes
SHA-256: b1b3b5ed376d3879c2bd6c29493459667e3072487c1b6ecba747868298c3f2c0

Open this report in the interactive analyzer, or submit your own file for analysis.