Malicious PDF — malware analysis report

Static analysis result for SHA-256 a225fbf06bcf62fc…

MALICIOUS

PDF

71.9 KB Created: 2021-04-21 18:14:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e19e72aae93cbe200f29e4de160ce333 SHA-1: e7750f506b66a090547ff0d7e292176ac551e0b2 SHA-256: a225fbf06bcf62fc8c95ff0d60e0eacb16b8588cb4de8dfde95f395492180bfa
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious phishing content. It contains a large number of external links, many pointing to other PDFs, suggesting a link farm or redirection mechanism. While no scripts were explicitly extracted, the PDF structure and the nature of the links indicate it's designed to lead users to malicious sites or content, likely as part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=murray+mower+replacement+parts
    • https://cdn.sqhk.co/zodavujera/HfP0jaQ/dipukeg.pdf
    • https://cdn.sqhk.co/rovifatira/ijdrRD9/jamafipo.pdf
    • https://cdn.sqhk.co/tibapopedeka/heifF2v/zubajibifuxaveridatupove.pdf
    • https://milonotupilo.weebly.com/uploads/1/3/5/3/135347339/6753731.pdf
    • https://cdn.sqhk.co/gabamulijawe/gijjFie/download_game_sniper_3d_gun_shooter_mod_apk.pdf
    • https://cdn.sqhk.co/jubawiwa/gehiBhi/7384635894.pdf
    • https://cdn.sqhk.co/mivufarowiwi/oNig5yo/jonanimefaputawererev.pdf
    • https://sudarotabodubig.weebly.com/uploads/1/3/1/4/131407445/4059239.pdf
    • https://cdn.sqhk.co/rovukupovumo/gdWzife/duzujujoxatiselotobopu.pdf
    • https://cdn.sqhk.co/mawetadu/jddu6Iu/my_billing_information_being_declined_app_store.pdf
    • http://wovugikanagak.scienceontheweb.net/busutaboreleberub.pdf
    • http://wotidoteked.mywebcommunity.org/68357553405.pdf
    • https://cdn.sqhk.co/begokaxawip/bwYjhqV/juventus_fixtures_and_results_2020.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://63995da9-74be-4895-8497-a4fa53c9845d.filesusr.com/ugd/788c84_a02a2e4ad54548218eccee49598e3a29.pdf?index=true
    • https://2aa89031-56ac-4de1-b828-aabe99840ec8.filesusr.com/ugd/cf14a4_1d9ea9d6ed604c989e6ea52aaa23faad.pdf?index=true
    • https://8a833fea-7c9a-4d2e-a5a7-d3590f42a3e5.filesusr.com/ugd/9aab09_580e674ad9bd487ebeb6894b4c4fe830.pdf?index=true
    • https://c546c886-5aa5-41cc-813f-4ed3e146772c.filesusr.com/ugd/b3e52d_bcd86bd1371d43f791faa508ef86929c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcef.bin
cd047064293039de5590a4e18ef34c035da42dd2fee1263d51df7d9785682ead		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDCEF 5276 bytes
font_01_sfnt_off0000eeec.bin
08b06b2bdc4f3d0e5e6aff9f761b56bea6ffa742a95c4cc684fa5dc1b4add642		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEEC 10472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.