Malicious PDF — malware analysis report

Static analysis result for SHA-256 93c0916e042093e1…

MALICIOUS

PDF

79.0 KB Created: 2021-03-11 12:09:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 3336c3a4646be1c4f42fd0364994ffcc SHA-1: 4b7205521dd01aae79976551e9c03e4fa934fedf SHA-256: 93c0916e042093e18b9d3edcff8237cc82c30081043e526d072ab606b572ff94
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, indicating it is likely part of a link farm for SEO manipulation or to redirect users to malicious sites. The embedded URLs suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=afterlife+the+strange+science+of+decay+answer+key PDF link annotation
    • http://sedouche.xyz/sogozinunoluxezamofozanornt2v.pdfIn PDF document text
    • https://padipemoton.weebly.com/uploads/1/3/0/7/130739419/welinevafudejox_fijekibikare_velolo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449399/normal_603a7cb9045ce.pdfIn PDF document text
    • https://gitexapovaje.weebly.com/uploads/1/3/4/4/134464395/gefiluw.pdfIn PDF document text
    • https://fuxomiluzixoxam.weebly.com/uploads/1/3/4/5/134594746/runijizuzore-losemawetibi-jojimuz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457572/normal_5fe1877594454.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366374/normal_5fed464692fdb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385421/normal_5fe292f85576d.pdfIn PDF document text
    • http://mosquito.codes/ncert_maths_book_class_10_in_gujarati3tmz8.pdfIn PDF document text
    • http://goodsun.fun/nefrologia_clinica_avendao_4ta_edicvl5p1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/09a84be2-b5a2-41ff-a347-7b5ef81706f5/88254511879.pdfIn PDF document text
    • https://s3.amazonaws.com/fobupojowojon/hp_elitebook_x360_830_g6_datasheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/04a3ba0e-6f95-48f1-ba78-a3b25d96af0a/fisufi.pdfIn PDF document text
    • https://s3.amazonaws.com/xakusineba/predator_3500_inverter_generator_specifications.pdfIn PDF document text
    • https://s3.amazonaws.com/vigevot/campaign_finance_reports.pdfIn PDF document text
    • https://s3.amazonaws.com/setikizo/waxukevebefisejolukozav.pdfIn PDF document text
    • https://s3.amazonaws.com/gelawiweza/rirudosexu.pdfIn PDF document text
    • https://s3.amazonaws.com/bogijexu/behavioral_activation_workbook.pdfIn PDF document text
    • https://s3.amazonaws.com/kewakuko/dell_s2340m_dimensions.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebe8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBE8 5320 bytes
SHA-256: a15856258d41177dcb152db5c6349bb200d3e6aff5a067c77af869a02b38518e
font_01_sfnt_off0000fe01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE01 10108 bytes
SHA-256: a4581f66739c084b994f64d95921876ddb9ce1a594913c03d3af32ddc0c9708b
font_02_sfnt_off0001205e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1205E 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.