Malicious PDF — malware analysis report

Static analysis result for SHA-256 93d590dcf0b1bd30…

MALICIOUS

PDF

108.6 KB Created: 2021-04-07 18:48:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f5b94158693dd163b5cd97658fbd2753 SHA-1: b57b7e11aa54a55bf09ccbf9fc1a8e00d21d9242 SHA-256: 93d590dcf0b1bd309809861b8787831b37412efbb07dcb0cf88f1037d614de40
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a malicious intent to redirect users. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically a phishing or trojan threat. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of techniques used to deliver malicious content or redirect users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=como+se+hace+un+informe+de+policia+judicial
    • https://cdn.sqhk.co/vapatibu/ypnHjij/kizimubewukemax.pdf
    • https://cdn.sqhk.co/zapimafe/rHhdibr/scary_camera_prank.pdf
    • https://cdn.sqhk.co/jumifokujuje/jbAgfjb/59952345242.pdf
    • https://foboxujegi.weebly.com/uploads/1/3/4/6/134694162/329bc.pdf
    • https://cdn.sqhk.co/kajipazuto/Sicghhc/12175489675.pdf
    • http://toolsbestpricemicrometer.site/husqvarna_725exi_spark_plug_gapa4kjv.pdf
    • https://cdn.sqhk.co/ravuviwidi/UAgiFha/dump_truck_crafts_for_preschoolers.pdf
    • https://cdn.sqhk.co/duxadikoti/idjjjbi/subwoofer_bass_booster_app_store.pdf
    • https://cdn.sqhk.co/vonezositixi/heiaqgj/26641209645.pdf
    • http://rm-swis-mine.com/screening_of_antifertility_agents49rus.pdf
    • http://fishland.store/power_book_ii_ghost_episode_9_release_datebaby9.pdf
    • https://vaturelola.weebly.com/uploads/1/3/4/7/134704713/1a090.pdf
    • https://cdn.sqhk.co/relulapezele/Onphhhc/ice_cream_blackpink_dance_download.pdf
    • https://cdn.sqhk.co/munenetifu/hf2jdm2/zefedopuvebokepit.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f102d602-ffb8-472d-a692-84204bcd0bbf/sony_cdp-ce375_specs.pdf
    • https://uploads.strikinglycdn.com/files/0cb16b97-2219-45bc-8880-73db6defa399/effective_communication_skills_in_relationships.pdf
    • https://3eeb541e-75be-486c-a732-b1e279b2a932.filesusr.com/ugd/eaab1c_67150775f586466896a8d58c8fe9738d.pdf?index=true
    • https://331e17ce-4321-42a7-89aa-067eaa3daeeb.filesusr.com/ugd/6576ad_68d401fae54c42c1b4bf8379adb09674.pdf?index=true
    • https://849bdae7-2456-4570-9e2a-fc769e7e49ad.filesusr.com/ugd/2074c9_5a228576c7194819ad0bc70be62b8573.pdf?index=true
    • https://8c77b9b7-c39b-43d6-9406-6086bd2c0f93.filesusr.com/ugd/ee6770_89fe2d5c7ebd460fab041ee2053e041b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016960.bin
8baa686c46fb7509f672e6550ad773a7b90b516bc37ea3fa27113258bba8f623		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16960 5376 bytes
font_01_sfnt_off00017b82.bin
14fdd05b0e80c3d63e76d0fc40d102c01648226c7a9a4bdddc2c35b947e44eb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17B82 12304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.