Malicious PDF — malware analysis report

Static analysis result for SHA-256 90236822cf9aa3b7…

MALICIOUS

PDF

90.0 KB Created: 2021-03-17 06:12:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cabc6a8e194169fd849b2661527bce96 SHA-1: ef0feb65b5b9cd22fa24a6374bfffe3156246238 SHA-256: 90236822cf9aa3b79c2f7abe3acf4fe32ececa34e6cd075d39359500a23f3333
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a technique often used to redirect users to malicious websites for phishing or malware downloads. ClamAV and ML classifiers strongly indicate maliciousness, specifically flagging it as a phishing trojan. The presence of embedded URLs and the PDF structure suggest an attempt to disguise malicious activity as legitimate document content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=rhetorical+strategies+pdf
    • http://sebofafekorav.iblogger.org/wepur.pdf
    • https://cdn.sqhk.co/vugasoveg/1ege1jf/dufopuzilufigi.pdf
    • https://fesitafixob.weebly.com/uploads/1/3/4/6/134653549/lesobagulepinugonib.pdf
    • https://cdn.sqhk.co/tovipovo/jd2WYRZ/21151576973.pdf
    • http://fragcups.com/jugonibolananuxarniqrj.pdf
    • https://besekexedonake.weebly.com/uploads/1/3/2/7/132741764/1778705.pdf
    • https://cdn.sqhk.co/mujawiru/jh3JDPx/australian_curriculum_information_report_rubric.pdf
    • http://autobaff.xyz/how_to_merge_tables_in_google_docs_on_macoxu4v.pdf
    • http://noverst.xyz/is_dunkin_donuts_egg_and_cheese_wrap_healthy1scpf.pdf
    • https://xuzizalebu.weebly.com/uploads/1/3/4/7/134772475/6f8355.pdf
    • http://winfreeiphone.xyz/begupusodikisofexokuje6n7.pdf
    • https://cdn.sqhk.co/potekovibe/gdgevia/bikini_bottom_genetics_incomplete_dominance_answer.pdf
    • http://shoop-fh.ru/hashar_2008_full_punjabi_movielq6wi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://afa032df-bfad-47da-a9c8-c79260182993.filesusr.com/ugd/6f9b04_cd744269bea341358ada9318ec77e694.pdf?index=true
    • https://s3.amazonaws.com/legapatatezisa/attention_getter_examples_for_informative_speeches.pdf
    • https://84bd2c60-91d0-47b6-9565-6ae8a6593e58.filesusr.com/ugd/963627_f51bcc601bea4dccae8da0ac72113a04.pdf?index=true
    • https://04a80c79-134c-446e-801b-0c1635678e59.filesusr.com/ugd/5cebf8_87c1e330192a401cabf8c399cf6e44de.pdf?index=true
    • http://vivizegijarugip.epizy.com/68352825946.pdf
    • https://s3.amazonaws.com/mejobu/introduction_to_composite_materials.pdf
    • http://bevavotubuzepu.rf.gd/roland_barthes_a_lover_s_discourse_fragments.pdf
    • https://f9a132f0-acc9-4761-b7d8-38025aedd849.filesusr.com/ugd/5c71d6_8d341f6cea114304b29ece94f5dd5295.pdf?index=true
    • https://dc010c70-835d-4b56-8cb0-1e1bda7cab64.filesusr.com/ugd/fb576b_b1780e7056904f769dade3fb53c6611a.pdf?index=true
    • http://tobezizasatixib.epizy.com/32550849715.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011561.bin
8d1b6e9b0b5d381fc00f35034fdabfc5462ab2d92109c30a32a51ef22d07a380		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11561 5424 bytes
font_01_sfnt_off000127c9.bin
64c9b95a5096266ee5061149746d494e7647c4229b6726fe95b2a4c2452d216b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127C9 2712 bytes
font_02_sfnt_off00013311.bin
ba4b82386eceb2147c71ef5db81f899fa860da8e52c6682045d41107322cba12		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13311 11480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.