Malicious PDF — malware analysis report

Static analysis result for SHA-256 97416912e1a2e0b3…

MALICIOUS

PDF

80.8 KB Created: 2021-03-22 12:04:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9de89cc2b270e632c5d40a785e53d785 SHA-1: 2a5cfd4b52d9a6547bcc80fa6eaf95e00b9f2444 SHA-256: 97416912e1a2e0b37ff850847fda8b374442a7a468a57de84d5c6d3bd7b957ca
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for link farms or phishing campaigns. One critical heuristic identified a PDF link farm, and another flagged the document as malicious based on ML classification and ClamAV detection. The embedded URL points to a suspicious domain, likely serving as a lure or a distribution point for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=how+to+do+basic+math+fractions
    • https://cdn-cms.f-static.net/uploads/4379859/normal_603002e95662d.pdf
    • https://cdn-cms.f-static.net/uploads/4380070/normal_5fda15fa0f1f2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4ea4b992-c674-4962-bf29-a442ca31c07b/xagaxonurupubefasi.pdf
    • https://s3.amazonaws.com/xufoxorog/que_significan_las_bolitas_del_rosario.pdf
    • https://71bfc0c6-4bef-405a-aee6-9e9dcaab3d12.filesusr.com/ugd/708cfd_8d5b244c90ea494182651a3fe2c8fc04.pdf?index=true
    • https://s3.amazonaws.com/gedesisumi/how_much_is_a_good_inversion_table.pdf
    • https://s3.amazonaws.com/zolerazowubow/contoh_report_text_singkat_beserta_strukturnya.pdf
    • https://s3.amazonaws.com/fuwenoxuzasila/don_carlo_cavina_school_uniform.pdf
    • https://uploads.strikinglycdn.com/files/97e42d3d-ffc8-4956-9d79-4238a94b2e75/characteristics_of_good_academic_writing.pdf
    • https://s3.amazonaws.com/lusabifef/56305595019.pdf
    • https://uploads.strikinglycdn.com/files/b96c04af-d17a-4bed-b97d-4dfc31ae2a75/math_worksheets_for_1st_graders.pdf
    • https://uploads.strikinglycdn.com/files/9f4f3b39-5e99-4fdf-9b01-db7e3005083a/thank_you_for_being_late_thomas_friedman_free_download.pdf
    • https://s3.amazonaws.com/vixuwogetiv/parasitologia_rey.pdf
    • https://uploads.strikinglycdn.com/files/96f95f6a-c379-4a5f-bf2c-1a16da24d0d8/how_to_make_a_lemon_garlic_butter_sauce_for_chicken.pdf
    • https://s3.amazonaws.com/laginekux/25928571487.pdf
    • https://c03439ef-6557-4199-865e-586791a52b6c.filesusr.com/ugd/6bb4a2_2a39b306058c442490df84b61a597baa.pdf?index=true
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_f63c4c44e25e4cf8b07608dcd8d5b24e.pdf?index=true
    • https://56db2a4d-09ce-4ff6-a558-abb1d6727cd4.filesusr.com/ugd/003b86_735d86bc9c704d308845098753cdd6fe.pdf?index=true
    • https://s3.amazonaws.com/nonabafat/31097098805.pdf
    • https://uploads.strikinglycdn.com/files/10bdbc60-a27f-4b76-a961-b982db49e0e4/95412553110.pdf
    • https://uploads.strikinglycdn.com/files/59d49e77-a5f3-4792-9da2-1cdcfc829097/nojidi.pdf
    • https://1b53f64c-3596-40ff-86ea-95cec8902569.filesusr.com/ugd/838e7e_36cff8709b6e48b09f60b7c5bef987aa.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ded82e19-b705-43ea-b3dc-401ea65f9baf/how_to_move_knights_in_chess.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe34.bin
029df2fba03bdc0436f7b4e915da5825e6876308070de6db23a51dd12ef8f810		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE34 5424 bytes
font_01_sfnt_off0001108d.bin
fd7dc3d19f0243c3319ecf798b3ecf88ccd4ced30f8c40b745cd2f4763920d4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1108D 11036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.