Malicious PDF — malware analysis report

Static analysis result for SHA-256 a955bc3a12ad4b31…

MALICIOUS

PDF

82.0 KB Created: 2021-04-07 02:26:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0578d0de5e7fb91a72a4b16637ce038b SHA-1: 58561d425bbf4ff8f45460779c0313cb5bd08098 SHA-256: a955bc3a12ad4b31850bd9b6782afcdf4a5c498bc91a712cedc602532c1f947e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, suggesting a link farm or SEO abuse tactic to direct users to potentially malicious sites. The document body, though heavily obfuscated, appears to be a lure related to educational worksheets, further supporting a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=biomes+reading+comprehension+worksheets+pdf
    • https://zunexoxefa.weebly.com/uploads/1/3/5/3/135340588/pokibuvat.pdf
    • https://metogixum.weebly.com/uploads/1/3/0/7/130775033/6736174.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2c525017-d59f-4ba9-be63-0f2ffd493067/how_to_find_trig_values_of_special_angles.pdf
    • https://uploads.strikinglycdn.com/files/d70ac267-82cb-4f79-9371-2b862c376433/jepupubodipitopawalad.pdf
    • https://uploads.strikinglycdn.com/files/f61c69b7-150e-4268-9e47-57e154c5884b/who_said_smartest_guy_in_the_room.pdf
    • https://e942959e-95af-4115-ab05-a6e38533eaad.filesusr.com/ugd/66f7a0_2522b24a1cdb46f7ba2acbccab08a98f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ca277f49-11b1-4545-bfa3-5d189f4b4996/11641530859.pdf
    • http://xowevabi.epizy.com/korg_volca_sample_guide.pdf
    • http://zaxutakizet.epizy.com/44464836427.pdf
    • http://pixutuvaw.rf.gd/antonyms_worksheet_for_2nd_grade.pdf
    • https://9fb0fece-6c2a-4f8b-8ff1-5d9ea67f5ee7.filesusr.com/ugd/f6a907_68626d6695154d82ad99f9d4a82753c3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/135c16ad-cc5a-4c03-81e1-cb43945f2e93/xujer.pdf
    • https://176fe727-baa2-4f6f-8ab0-cddcd97ecb74.filesusr.com/ugd/45df28_3546731bb0e14b6cb9c109b6d614060b.pdf?index=true
    • https://9e77dbea-16d6-438e-9859-4a68c5388828.filesusr.com/ugd/3225da_c2041e0498224bdda827dbfd9ca08cc0.pdf?index=true
    • https://d52aed46-be45-4f9b-8106-cf6fc7ee66c0.filesusr.com/ugd/b148e5_bbbdd5cf80f64a69bad44019e568e333.pdf?index=true
    • https://748e6e98-33e2-4bd1-95aa-01ea3505a154.filesusr.com/ugd/704f6c_c2c19c31dfb44f70a537f5ef640df739.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cad8daf5-ca73-4355-8249-1d1161d5666f/lifesource_ua-767_plus_manual.pdf
    • https://d6aab468-caab-4d9e-910f-d3bf64ae4104.filesusr.com/ugd/5438e3_b63fca797abe448ba322d36d8683b9c2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001013b.bin
3a4f8c0aa1aa7298c3621a1493feaa86b3765465815d7eb6dc7d86d772e42e4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1013B 5744 bytes
font_01_sfnt_off000114af.bin
656f73128f2c6938d4855d6540a5a258dbadf5c7d748d00296b0f9d08fda7950		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114AF 11056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.