Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0a8e246e7ce19c5…

MALICIOUS

PDF

86.7 KB Created: 2021-04-25 16:45:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8868dc5a41a5eeb66e530a37d8b0d80c SHA-1: 79988fc6a12fd00542a06491969abcc7b5223253 SHA-256: a0a8e246e7ce19c543fd189044b5dd0908467d1a8d662c8538cade283df03073
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one specifically pointing to a URL that appears to be a lure for a movie script. The 'PDF_SEO_LINK_FARM' heuristic indicates a large number of external links, suggesting a malicious intent to distribute content or redirect users. ClamAV detection and ML classification further support the malicious nature of the file, likely a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=a+christmas+carol+movie+2009+script
    • https://napolodakuziman.weebly.com/uploads/1/3/0/7/130775867/pesuliru-kufufepoze.pdf
    • http://dumubemajizukov.medianewsonline.com/sat_practice_test_7_answer_sheet.pdf
    • https://cdn.sqhk.co/zenekukera/bijord2/hoffman_estates_high_school_report_card.pdf
    • https://nexirexosevexos.weebly.com/uploads/1/3/4/5/134500935/e0a76035a.pdf
    • http://zonojebiridizo.mywebcommunity.org/vupenetika.pdf
    • https://xuberirerumona.weebly.com/uploads/1/3/4/5/134586272/4978bdd.pdf
    • https://cdn.sqhk.co/jalafimimodo/Pidgjij/77988345251.pdf
    • https://vowebaxuzifov.weebly.com/uploads/1/3/0/7/130738870/tivikupupatadoje.pdf
    • http://buzevuzelape.mywebcommunity.org/frigidaire_refrigerator_fgus2632le0_parts_list.pdf
    • https://rogupogadagome.weebly.com/uploads/1/3/1/3/131398605/6597877.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b36ad067-21ef-4b17-9055-1dfcbb3fb98c.filesusr.com/ugd/8673ad_e49c6a8350a94e21b22ec65e611ebb0a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c8e542a8-b671-4ace-ab44-e1d28af9f4de/sri_rudram_mahanyasam_telugu.pdf
    • https://s3.amazonaws.com/rijaliwiguvex/xirukeliranuzinixenitorel.pdf
    • https://s3.amazonaws.com/jepinebawo/meliferazuwiwuzupizigovo.pdf
    • https://uploads.strikinglycdn.com/files/be77a421-4926-4d21-b633-9b15647ec70d/baofeng_uv-5r_range.pdf
    • https://uploads.strikinglycdn.com/files/12749205-c9a7-4594-a20e-7969cb1b2593/dnd_character_sheet_meaning.pdf
    • http://varirojemixu.myartsonline.com/gajarogunategokovukokogej.pdf
    • https://968bac2e-1409-45a7-bd11-2c37eba47390.filesusr.com/ugd/c81504_d37e73bb60b245e994439066a0df1743.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b686e20e-9d1f-4e68-9aad-9542bbf83928/line_6_pod_xt_pro_software.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000114f6.bin
3641debb4448fa4aeea6e94db85cb261ebc714a3d120f1ff3d7128f79bd0aefb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114F6 5652 bytes
font_01_sfnt_off00012800.bin
b0c2ce848dda5c9ddaf4417a19e1b00a9eaa741bd1c8a7b4fd40b3eeea29da9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12800 11060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.