Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a38ac2c48789ecb…

MALICIOUS

PDF

81.7 KB Created: 2021-06-14 09:25:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 601bbbcf92d1ec39edf45a0b55c0ffd0 SHA-1: cf0d505c3fa6e57ee4cddc0ef034490746b10dac SHA-256: 9a38ac2c48789ecb8528ba680ba7b917eafd387fb01e79f2ccade6c560062bef
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. It contains a large number of external links, including a suspicious URL related to 'nude pics of christina anstead' and a link to another PDF, suggesting a link farm or redirection to malicious content. While no scripts were explicitly extracted, the PDF structure and the nature of the embedded links strongly indicate a phishing or malicious content delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/pbw?utm_term=nude+pics+of+christina+anstead PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4500910/normal_5fe2c2671cc21.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465387/normal_602812cef2894.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4530457/normal_6056ba9d22e2c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415756/normal_600250218ab4f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421614/normal_60011c815c517.pdfIn PDF document text
    • https://tenipimip.weebly.com/uploads/1/3/4/0/134042327/5785937.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386621/normal_5fc6b6e156b83.pdfIn PDF document text
    • https://kivasemav.weebly.com/uploads/1/3/2/6/132680863/4602754.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426059/normal_5fef4e0c14e2a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409998/normal_60276950d1f03.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367279/normal_60162da34b769.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384145/normal_5fd17dfb8f97c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410018/normal_6064b5e9d5910.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9664007-0066-48f2-be61-da487e569ddb/libro_de_matematicas_2_de_secundaria_contestado_savia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f8ae4dd-df83-4817-af10-6854e362f362/how_to_help_struggling_readers_in_first_grade.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a9873f7-44e6-4896-845f-c8ff11a384b2/51516051165.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69747192-8425-4280-95d5-e78bb5bb598a/how_the_grinch_stole_christmas_book_read_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a53e27a-6c99-429b-9641-82a195736357/how_much_do_crime_scene_investigators_get_paid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16f468a2-43cb-4b06-bf7c-284cd7c683ed/why_is_the_red_light_flashing_on_my_panasonic_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4506a164-8f84-4f7d-b6a2-3aaed6a7685f/cessna_182_illustrated_parts_catalog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2b8d0e2-a2f9-4166-a640-49b376e59e0a/fakaxamapagigelo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbc12b13-9569-427f-b42d-e35c1cf39a61/wetov.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFD2 5180 bytes
SHA-256: 23658cd0ff1dd127be279bf78f35a17522d52e44a00a9a4735d87ab27335976e
font_01_sfnt_off0000f16c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF16C 4640 bytes
SHA-256: 83330439c7d1cb7b71125d67dbae7dee24a863bbf539dd6bd6f884d48577c3ad
font_02_sfnt_off0000fe0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE0E 11104 bytes
SHA-256: 31196c389372509a00d4ea86bfd95b69ed3298ad205478ce578691e777b987f5
font_03_sfnt_off0001245b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1245B 16036 bytes
SHA-256: 9559dd1bd908241551916101fda3d445a26f5c4b506a1423f23393456f9d5940