Malicious PDF — malware analysis report

Static analysis result for SHA-256 a767718a1b672d46…

MALICIOUS

PDF

79.5 KB Created: 2021-04-03 22:04:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a7e15319ae071868771ef89c3b2c4aba SHA-1: 9e45677c515593435557b10477ff6b90ba259a25 SHA-256: a767718a1b672d46c7d7c99062444b712e4a199ca81f10555baff4b66676e954
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used for SEO poisoning or to redirect users to malicious websites. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. The presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' suggest the primary goal is to drive traffic to external sites, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=paragon+digital+defrost+timer+wiring+diagram
    • https://domafotenok.weebly.com/uploads/1/3/5/9/135973376/fc9f9.pdf
    • https://cdn.sqhk.co/wazuvegox/iEjhFjc/ligovol.pdf
    • https://cdn.sqhk.co/mubogasaven/Eujbdjh/88273718038.pdf
    • https://fosegeluka.weebly.com/uploads/1/3/4/7/134717840/kuvubojozolu_jabiteno.pdf
    • https://garowowo.weebly.com/uploads/1/3/6/0/136033653/pavuvumowod-wufijeso-jiwugugefoxase-jefogevasaf.pdf
    • https://simokatojerosu.weebly.com/uploads/1/3/0/8/130874490/3387750.pdf
    • https://cdn.sqhk.co/soxosovave/ggs0Sql/black_rifle_coffee_club_canada.pdf
    • https://zavadogo.weebly.com/uploads/1/3/4/3/134325895/webed.pdf
    • https://tipidaxu.weebly.com/uploads/1/3/0/7/130739537/ditiditu.pdf
    • https://cdn.sqhk.co/rularijulen/cJQhfAn/kikkerland_pendant_cord_lamp.pdf
    • https://jebezijako.weebly.com/uploads/1/3/5/9/135964749/xupabupuvededuz.pdf
    • https://cdn.sqhk.co/putizimetiwe/cYji520/monster_car_hill_racer.pdf
    • https://cdn.sqhk.co/tirazirevemu/icNagib/first_video_game_console_pong.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1c27aa68-c202-410d-bd40-23d04559d459/96354480921.pdf
    • https://uploads.strikinglycdn.com/files/0e8b23f3-d8e1-4776-854b-929370ef7e37/95694682695.pdf
    • https://uploads.strikinglycdn.com/files/2f8b9203-91a2-4e10-8027-39b8a4ae353c/vegadafavixeveforiz.pdf
    • https://s3.amazonaws.com/vufuzewasi/sample_reflection_paper_in_apa_format.pdf
    • https://uploads.strikinglycdn.com/files/4c5544ac-34d0-44aa-987e-e4a7cd1fff2d/what_is_the_formula_for_final_speed.pdf
    • https://s3.amazonaws.com/wezukep/vedorapovuti.pdf
    • https://s3.amazonaws.com/bitajemisajoz/27980034424.pdf
    • https://uploads.strikinglycdn.com/files/a2f34949-c0bc-48fe-a043-295d8d991598/89546482351.pdf
    • https://s3.amazonaws.com/jidosatikim/naferajomefapixojavonuwa.pdf
    • https://s3.amazonaws.com/donukadizolin/ffxi_escutcheon_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f48d.bin
24e969c65c818c42e12ca71697576f7d03fd79d24781254da8a3d9a2f3188a01		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF48D 5320 bytes
font_01_sfnt_off000106a0.bin
9c08aef228f1bc5956f3379bf5faa26ebbeea51b969406e857671ddc3bb6912c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106A0 12220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.