Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f25523ddd868d95…

MALICIOUS

PDF

85.3 KB Created: 2021-04-22 20:41:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3864d960d334a900f912b30ca44e7bd5 SHA-1: 71e5262bad70a0cf0199aa3025c14a82f99746e3 SHA-256: 8f25523ddd868d9555be920b1e12e5feedb40100ced349060d3973110b851168
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, and is flagged by ClamAV as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to shell scripting examples. The primary malicious activity observed is the redirection to external URLs, likely for malware distribution or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=shell+script+basic+commands+with+examples
    • https://cdn.sqhk.co/wujugojuse/nihghge/conor_maynard_ft_anth_hello.pdf
    • https://medefidonirefej.weebly.com/uploads/1/3/5/3/135324812/9bfc455a4cc.pdf
    • https://static.s123-cdn-static.com/uploads/4471958/normal_5fccf54b6f807.pdf
    • https://zonilalafujagep.weebly.com/uploads/1/3/4/7/134731182/318e6e.pdf
    • https://cdn.sqhk.co/fetesulatol/drhjQ9K/adiemus_karl_jenkins_sheet_music_free.pdf
    • https://mavujaxubuxabo.weebly.com/uploads/1/3/0/7/130775304/pomujujem.pdf
    • https://cdn.sqhk.co/bemaxopig/icfiiaq/91335355617.pdf
    • https://vugogirofezufus.weebly.com/uploads/1/3/4/3/134355312/89e5b2ae74a5.pdf
    • https://nesujuge.weebly.com/uploads/1/3/1/4/131407687/b6c0204c486.pdf
    • https://luvisumor.weebly.com/uploads/1/3/5/3/135390586/3589183.pdf
    • https://static.s123-cdn-static.com/uploads/4501632/normal_5fff07dcc9b47.pdf
    • https://veduwasa.weebly.com/uploads/1/3/1/6/131637496/gadubo-senosere.pdf
    • https://gunobome.weebly.com/uploads/1/3/1/3/131398345/nukotaxej_bajixufovogu_ximijajovifefo.pdf
    • https://cdn.sqhk.co/naziwixolagu/2pitEgg/29493161310.pdf
    • https://cdn.sqhk.co/javeduner/ejdwjh3/47011423465.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xuzed/36801487031.pdf
    • https://s3.amazonaws.com/boduxatavepe/11030421714.pdf
    • https://uploads.strikinglycdn.com/files/f4abe2b1-6f82-4dba-a018-abe7e7ccde00/how_do_you_say_hey_beautiful_in_jamaican.pdf
    • https://uploads.strikinglycdn.com/files/9a05a5d3-44ff-40ca-bf84-0a596244ae27/2017_jeep_wrangler_owners_manual.pdf
    • https://uploads.strikinglycdn.com/files/3512d94d-6aba-472b-ab17-9d8e91048573/tp-link_tl-wr841nd_v3_firmware.pdf
    • https://uploads.strikinglycdn.com/files/4dec8d4c-99bd-4f09-836b-a55930ce8353/does_bob_die_in_a_street_cat_named_bob.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c37.bin
3d6c27474b4f1b389f3ea5324d948c1e57840668b0ae1576c147f7aea72d8432		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C37 5716 bytes
font_01_sfnt_off00011f8c.bin
6721a5908a0b3cafeda6c5b17fd97f9325a9125c1e96c329ef223601c26074b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F8C 11636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.