Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fc08409b812cf88…

MALICIOUS

PDF

73.7 KB Created: 2021-03-16 21:03:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a387604d1e14daacc71dee6f54c89039 SHA-1: deb310301dee2257f72b57fd413dec6bdb2935e2 SHA-256: 9fc08409b812cf88873ea8e1607621a9fb6823b93aec8645107166827eb594a9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or malware distribution lure. It contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or SEO manipulation tactic. The embedded URLs likely lead to malicious content or further stages of an attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=lamina+galvanizada+lisa
    • https://kafolegilu.weebly.com/uploads/1/3/2/3/132303068/8209612.pdf
    • https://fajuvupo.weebly.com/uploads/1/3/5/3/135310445/44f3687d43b5600.pdf
    • https://cdn.sqhk.co/zowonefaso/gcmWihx/minecraft_crafting_and_building_mods_1._15._1.pdf
    • https://cdn.sqhk.co/kosenopelid/higibgh/red_princess_dress_up_dresses.pdf
    • https://woduluzotuni.weebly.com/uploads/1/3/4/3/134373450/2766771.pdf
    • http://naligixe.getenjoyment.net/pekekomejegawuzuzowus.pdf
    • https://cdn.sqhk.co/salefudodid/FGW0Ige/hockey_nations_18_online.pdf
    • https://wegabikiwapalev.weebly.com/uploads/1/3/5/9/135992979/1379033.pdf
    • https://cdn.sqhk.co/besiwowegin/wv2v2hf/jezunaz.pdf
    • https://cdn.sqhk.co/reruzemafow/ijgcYhi/39635605703.pdf
    • https://cdn.sqhk.co/gixotagokezu/bhathfF/amazon_prime_video_free_movie_code.pdf
    • https://cdn.sqhk.co/fixikumeboga/vgcHepW/nukowiloxurevul.pdf
    • https://cdn.sqhk.co/sukonazukuv/1hhfgeZ/vekimozexufezafo.pdf
    • https://didizotaxudip.weebly.com/uploads/1/3/4/6/134619455/pamofa_bewesizawanose.pdf
    • https://cdn.sqhk.co/gusiloxi/dvhdKFQ/kingdom_new_lands_wiki_dog.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://a2ae8793-a99f-480d-a3bc-849ef63d34f7.filesusr.com/ugd/cc207a_098d083b846e48558f96798ddf6c01b7.pdf?index=true
    • https://36d3fe4d-ce77-4ecd-ae21-04b42370c250.filesusr.com/ugd/871c54_2cd27fa7d99f43ed80b950edd8f1b84d.pdf?index=true
    • https://s3.amazonaws.com/votubukaxogilix/vtech_home_phone_answering_machine_setup.pdf
    • http://zesafemumibow.myartsonline.com/the_night_manager_series_1_episode_6.pdf
    • https://s3.amazonaws.com/tomaxade/medicin_de_la_calidad_ambiental.pdf
    • https://s3.amazonaws.com/wuniku/os_cuneiforme_laterale_dem.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1c6.bin
8f87c9153fc6ded6257d42e12221a68f55d820ed3d30dd652026119d50499bff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD1C6 4580 bytes
font_01_sfnt_off0000e132.bin
5a74e9f74717d621040ae245a6fd8bf5602fe5596ee64571161f74389c5c1fdd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE132 12744 bytes
font_02_sfnt_off00010a28.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A28 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.