Malicious PDF — malware analysis report

Static analysis result for SHA-256 a88152bb57461a84…

MALICIOUS

PDF

115.0 KB Created: 2021-04-30 03:05:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1396b3a656196d622aec9aaa261aeaef SHA-1: 53beab3e6c7cbefe3c4969ca7665006093a943be SHA-256: a88152bb57461a847309670d925262c151344577c013bab3e73f9594dfcb011d
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm with numerous external URLs, many of which are suspicious. The heuristic 'PDF_SEO_LINK_FARM' and 'SE_CALLBACK_LURE' indicate a phishing or scam attempt. The presence of external URIs and a large number of linked PDFs suggests the document is designed to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=how+do+you+renew+your+driver%2527s+license+in+ma
    • https://cdn.sqhk.co/mezadisedud/y6ibghe/73000135656.pdf
    • https://cdn.sqhk.co/taruvufufezu/7g1pjhf/23762616614.pdf
    • http://generalmassage.online/93017124847wlj28.pdf
    • https://cdn.sqhk.co/pozigafo/jibrC4P/kuboluwarejovuzus.pdf
    • https://cdn.sqhk.co/ludibipimilu/NbpCAjh/zefizijurola.pdf
    • https://cdn.sqhk.co/tivinarafuvu/gf2gipp/wopedo.pdf
    • http://afterdealer.pro/how_many_death_note_books_are_therengft1.pdf
    • http://nikecortez.net/how_to_charge_lg_bluetooth_headsetcmafi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3c45aaf8-24f3-4cde-9773-cf44a0a970d3.filesusr.com/ugd/ae7d54_f625e9f6a619431e824ea194369edceb.pdf?index=true
    • https://s3.amazonaws.com/xesigeze/firusekubegufi.pdf
    • https://s3.amazonaws.com/wizedumi/niguzum.pdf
    • https://9ebe8999-295a-4f11-87dc-c96f3e1b46ff.filesusr.com/ugd/8de238_856ae0fd645f490f81a938acdb3defb2.pdf?index=true
    • https://57eba762-b826-4879-8d7a-7f480aba2934.filesusr.com/ugd/e89c2b_8c012403d4774132804cd59fcd620aa9.pdf?index=true
    • https://e3e1c2aa-7f41-47b0-8c2f-d823cb48b857.filesusr.com/ugd/7598fa_7294b6244a8e4c0db7a0857b977c0880.pdf?index=true
    • https://dedb376b-efc3-4528-ac10-fc65d12f866c.filesusr.com/ugd/5f6074_9778df62686f4693a2a243b29e991d71.pdf?index=true
    • https://52c77544-2eb8-427c-ad0e-a8a7e2ea9366.filesusr.com/ugd/93288f_175230a341ea4f19b8e83b61c213b77a.pdf?index=true
    • https://d5fb4b5d-766d-4e54-ab1c-ecc61d2b7d82.filesusr.com/ugd/b0c8dc_6d275b98c1a54de290f454279879954d.pdf?index=true
    • https://51bf459c-6b46-41b0-863f-532cf8a77e0d.filesusr.com/ugd/2eedf1_8bb390b6674d49a5952476b23ea98198.pdf?index=true
    • https://8eeb1f0a-0cdd-4c66-98a4-83777b49fb54.filesusr.com/ugd/64f9d2_578e0265bc01441f8d688efbe4c38cbb.pdf?index=true
    • https://s3.amazonaws.com/juliziwojatige/1563281345.pdf
    • https://s3.amazonaws.com/vekodupiwarobi/kixubidare.pdf
    • https://94226b1b-8363-4ad6-a779-e61b7b16ff5b.filesusr.com/ugd/b3bc21_d7a35a01cfd148439b3edcfbee61d125.pdf?index=true
    • https://s3.amazonaws.com/nonipesikiri/wagner_paint_sprayer_comparison.pdf
    • https://da89e6ec-52f9-4c28-8de8-447a2e923c0c.filesusr.com/ugd/5e5b2a_e9225876be694f50b1a9456ba74fdff7.pdf?index=true
    • https://dca540c6-954d-4243-9f09-0921753db957.filesusr.com/ugd/974a4e_f2591f3684494cc6bfc69e116fc9dbee.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018006.bin
0a0ce3dbe7822fde918a40fee876c141ea0062cf03e638b3f1a0832593e7979c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18006 5332 bytes
font_01_sfnt_off0001922e.bin
676f12e7f382794efc5b15d75b07d80a524777f9c5ef1332894f07f462b04bcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1922E 12772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.