Malicious PDF — malware analysis report

Static analysis result for SHA-256 947cd99bc57a8aa3…

MALICIOUS

PDF

98.5 KB Created: 2021-04-07 05:32:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eeeaf0fda83160894fe7b51f819c5156 SHA-1: a9574ed228b2f4adf0b973c6f103dcf4e4069647 SHA-256: 947cd99bc57a8aa30858170ecf7f024f3d2530425d9124e0a57f62dde7299726
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains a large number of external links, suggesting a link farm or SEO manipulation tactic, with a primary lure related to "worry free money". While no scripts were directly extracted, the PDF structure and external URI firings point towards an attempt to redirect users to malicious or SEO-abusive websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=worry+free+money+pdf
    • https://cdn.sqhk.co/rabataxuvax/1Obhaii/rofabuwizelezapoduvatag.pdf
    • https://cdn-cms.f-static.net/uploads/4486548/normal_60626172b0c82.pdf
    • http://xulazawelinuze.scienceontheweb.net/alien_vs_predator_comic.pdf
    • https://static.s123-cdn-static.com/uploads/4448357/normal_5fe5915a4468b.pdf
    • http://zugasanuko.getenjoyment.net/textaufgaben_brche_6._klasse.pdf
    • http://xerijegodufiw.mypressonline.com/basic_mathematics_for_economists_3rd_edition.pdf
    • https://cdn.sqhk.co/wufotubi/TaigeUl/29961985310.pdf
    • http://tiriruno.sportsontheweb.net/retail_sales_assistant_job_description.pdf
    • https://cdn-cms.f-static.net/uploads/4445106/normal_603dc30a66b91.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/ce5d38be-58c5-4033-a658-b8fa8d497c4c/fomazusax.pdf
    • https://87098103-4d08-48bb-90a6-807b0ef734b2.filesusr.com/ugd/1f49de_7d3799f93a61451f8293570c14166c9e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8558db16-b828-4327-bba9-64171e4b61a2/best_exercise_for_elderly_at_home.pdf
    • https://uploads.strikinglycdn.com/files/37ae8a53-42ab-4692-85a5-64bdd27492f4/baropabukumu.pdf
    • https://6d428a25-da86-44fa-8f13-5b0f09742281.filesusr.com/ugd/3649d2_8b2b677d06a34826b272837eeaeefb38.pdf?index=true
    • https://uploads.strikinglycdn.com/files/01d2aeb3-ac45-4329-b2ce-b0ee052f865b/20411291743.pdf
    • https://uploads.strikinglycdn.com/files/0c3f7245-75ac-4916-9789-f26c0c60c6d6/mirro_pressure_canner_jiggle.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010bc3.bin
aa368566bbbb66d4b77153b0cfa55aa8ada3d31ad4b7c5dd4a9c7e1562fc7da3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BC3 13268 bytes
font_01_sfnt_off00013694.bin
eb7ad998c135bb771ee40e1371b6b2ee6530737f8f213f346dc5544c0489d633		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13694 4544 bytes
font_02_sfnt_off000145eb.bin
30dca13c3d9d7c5508f4bb60077dce322946dbd26bba548bb96db74bb3a4c97a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145EB 11524 bytes
font_03_sfnt_off00016cd8.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CD8 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.