Malicious PDF — malware analysis report

Static analysis result for SHA-256 9072676930a0967c…

MALICIOUS

PDF

79.5 KB Created: 2021-05-29 09:50:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f46defdeaaf902d969d5366a4bc07b9 SHA-1: 7ba1aad77a4af4213a80006f906fd71bf8708435 SHA-256: 9072676930a0967ce88b65572c24500280bc36855faaf1a8bd04ae23dadd7418
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to PDF files with numeric or generic slugs, suggesting a link farm for SEO manipulation or to host malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URL points to a suspicious domain, further supporting this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wb?keyword=xerox%20workcentre%207545%20cartridge%20price%20in%20india
    • https://salobejutar.weebly.com/uploads/1/3/4/5/134589592/1328008.pdf
    • https://cdn-cms.f-static.net/uploads/4386609/normal_60185d2f30685.pdf
    • https://gigiwejube.weebly.com/uploads/1/3/5/9/135984489/kabaxivaxuwo_kutitiris_rivusipumab_logalu.pdf
    • https://roxamemimo.weebly.com/uploads/1/3/4/5/134589570/535c622b77053b.pdf
    • https://wetokusoxuzufo.weebly.com/uploads/1/3/4/5/134508242/27e7ada5.pdf
    • https://static.s123-cdn-static.com/uploads/4380536/normal_6007bd504c2e4.pdf
    • https://static.s123-cdn-static.com/uploads/4460980/normal_5fc6215c7d376.pdf
    • https://xediziku.weebly.com/uploads/1/3/1/3/131384396/pogixaziriru_divivawula_xurarigutibuj_xabuzoz.pdf
    • https://static.s123-cdn-static.com/uploads/4403117/normal_5ff106e3426f9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ad756b7b-9faf-4ff3-bf74-934818b29ffb/6422755924.pdf
    • https://uploads.strikinglycdn.com/files/1fb7fe40-b59f-4bd6-90ca-38bc4a890506/46226625335.pdf
    • https://uploads.strikinglycdn.com/files/aabcab83-0f00-4edc-afbc-2eb625e258a0/11360481823.pdf
    • https://uploads.strikinglycdn.com/files/0ae92292-e9f7-463f-9f61-b14d6c16264b/depivevibutil.pdf
    • https://uploads.strikinglycdn.com/files/6d911115-34fc-4c29-a845-a4afc4258d1f/national_highway_traffic_safety_administration_field_sobriety_testing_training_manual.pdf
    • https://uploads.strikinglycdn.com/files/4ae55a0a-2125-4d52-a043-9581eb372cee/26378410593.pdf
    • https://uploads.strikinglycdn.com/files/47022d23-f306-454f-bfa1-f539cc5413a4/good_words_to_describe_a_jungle.pdf
    • https://uploads.strikinglycdn.com/files/9065b499-8389-4237-b255-dfd6f419eadb/20378355906.pdf
    • https://uploads.strikinglycdn.com/files/23eb8ccf-364d-4de8-acdc-e4b628ce6e95/how_to_make_simple_wood_joints.pdf
    • https://uploads.strikinglycdn.com/files/c167ac2a-4e78-415c-949d-6e68368e6c8a/logitech_k360_wireless_keyboard_manual.pdf
    • https://uploads.strikinglycdn.com/files/4e22a679-e37c-4d5d-a8a3-f0c8dbd9c4ea/bananitosinamijoso.pdf
    • https://uploads.strikinglycdn.com/files/cc3b800c-6a0b-41ee-b2e5-fda9e152bc0a/44614673537.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f336.bin
aa1d766e731bd929a98b78f01c3aa33b048a7506d98fc7e068b98e85031b685e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF336 5524 bytes
font_01_sfnt_off0001063e.bin
67942c40d0fc9e582ccd05c3124c782c353692dc2bb0939ab8de03791a77c2b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1063E 12388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.