Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7b3c41bbf1506c4…

MALICIOUS

PDF

78.9 KB Created: 2021-05-31 23:59:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2098a82918c15de75e5cb61ebb010345 SHA-1: b960d64392c12c2da03b1f861c20a858a733b1f8 SHA-256: a7b3c41bbf1506c42955c2f69cd30ef44ddb9e6949f68f5d0b1a73ed4959b952
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, identified as a link farm, and is flagged by ML classifiers and ClamAV as malicious. The document body, though truncated, suggests a lure related to iPhone repair, likely to direct users to malicious sites. The presence of embedded URLs and the overall structure strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=hard+reset+iphone+6s+plus+without+itunes
    • https://cdn-cms.f-static.net/uploads/4373526/normal_6021514e7c56d.pdf
    • https://zuxevuzefadum.weebly.com/uploads/1/3/0/7/130775429/7245381.pdf
    • https://cdn-cms.f-static.net/uploads/4492875/normal_601f38af5d514.pdf
    • https://cdn-cms.f-static.net/uploads/4453890/normal_604dc6d6ea7c2.pdf
    • https://gikotibosad.weebly.com/uploads/1/3/4/3/134332820/6860879.pdf
    • https://static.s123-cdn-static.com/uploads/4385862/normal_6002538345077.pdf
    • https://cdn-cms.f-static.net/uploads/4416318/normal_602f89eeaf1a5.pdf
    • https://cdn-cms.f-static.net/uploads/4414848/normal_6014484ea8cce.pdf
    • https://cdn-cms.f-static.net/uploads/4472206/normal_6024158a55fcd.pdf
    • https://woliwejimagevin.weebly.com/uploads/1/3/4/3/134319070/nudijovager-dajeripid.pdf
    • https://cdn-cms.f-static.net/uploads/4406463/normal_60669ca2ac0e3.pdf
    • https://dizakevusarebiz.weebly.com/uploads/1/3/4/5/134581037/3927703.pdf
    • https://static.s123-cdn-static.com/uploads/4389394/normal_5ffc97ee67d5d.pdf
    • https://poxozebirineba.weebly.com/uploads/1/3/4/4/134447173/7763012.pdf
    • https://cdn-cms.f-static.net/uploads/4387928/normal_6046acee8da8d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://viluxese.pbworks.com/w/file/fetch/144415128/how_to_run_originality_report_in_google_classroom_as_a_teacher.pdf
    • http://wiwedano.pbworks.com/f/67978952431.pdf
    • http://famukaser.pbworks.com/w/file/fetch/144423603/fajetedapawokevoxamupolo.pdf
    • http://nunaruribeg.pbworks.com/w/file/fetch/144414801/how_do_i_upload_to_kindle.pdf
    • http://negovijalulu.pbworks.com/w/file/fetch/144426354/lukujenulukonojimus.pdf
    • http://xalanupuzewo.pbworks.com/w/file/fetch/144419598/69222612279.pdf
    • http://pezeliv.pbworks.com/f/bloons_td_5_free_ios_download.pdf
    • http://jajisaparev.pbworks.com/w/file/fetch/144420567/mibezusaveno.pdf
    • http://rugewenuzed.pbworks.com/w/file/fetch/144426525/minecraft_mc_heli_mod_1.12_2.pdf
    • http://viluxese.pbworks.com/w/file/fetch/144413817/zuwedefizob.pdf
    • http://zemenifinabe.pbworks.com/f/78613616211.pdf
    • http://nigezid.pbworks.com/f/what_are_the_types_of_oral_literature.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eba8.bin
4073075a0fecced90736d6bc6aa3f6b69c2aa7cd80c316ba3f6372e9860caa3f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBA8 5136 bytes
font_01_sfnt_off0000fd1e.bin
600790be64d972430e8267371820ef90396c5b18c3eb950111962e5d41d4b5d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD1E 10416 bytes
font_02_sfnt_off0001209f.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1209F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.