Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9738531562030eb…

MALICIOUS

PDF

83.1 KB Created: 2021-03-10 08:04:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2cc0bae7e153f31d8dd31493a19abbc4 SHA-1: e60b1219b794781d11e29d1062286d90d05c5d60 SHA-256: a9738531562030eb320a26e53919c867ec07d516273d987306e43571347ca0bc
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to suspicious domains, indicating a link farm or phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and external links are indicative of a malicious document, likely used as a lure to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • PRC/3D content in PDF medium CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wb?keyword=trimble%20pole%20parts
    • https://siwomamijureg.weebly.com/uploads/1/3/5/9/135962198/e4e6af9.pdf
    • https://cdn.sqhk.co/bapisolel/ndVbQjj/50221937683.pdf
    • https://cdn-cms.f-static.net/uploads/4404122/normal_604679f592332.pdf
    • http://bawazofo.getenjoyment.net/tokyo_ghoul_re_manga_anime_differences.pdf
    • https://budazibidoware.weebly.com/uploads/1/3/5/3/135386773/1632202.pdf
    • https://wisapemewe.weebly.com/uploads/1/3/4/7/134713478/gosikorezoluw.pdf
    • http://pedumerik.sportsontheweb.net/64713828868.pdf
    • https://cdn-cms.f-static.net/uploads/4483836/normal_6046d366b7d93.pdf
    • https://vodazifuja.weebly.com/uploads/1/3/4/2/134265633/640011.pdf
    • https://kuxiwidozerapi.weebly.com/uploads/1/3/4/7/134728536/ninewopizatu.pdf
    • http://forovasax.medianewsonline.com/what_gun_companies_does_beretta_own.pdf
    • https://cdn.sqhk.co/wamefuvew/fgcgigC/dont_touch_my_phone_background_blue.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/531ca583-1aac-4723-8503-96124d047959/best_security_app_lock_for_android.pdf
    • https://uploads.strikinglycdn.com/files/4f78a073-f6ab-4983-ba53-e53b299cb179/delta_tribeca_4_in_1_crib-white_and_gray.pdf
    • https://uploads.strikinglycdn.com/files/600e38af-0a5c-492e-b0f6-2198aa6895ae/cabela_dehydrator_reviews.pdf
    • https://uploads.strikinglycdn.com/files/6ac165dc-c1ac-40ff-8b3f-6836dc05783c/29662739328.pdf
    • https://uploads.strikinglycdn.com/files/895ae3cf-823e-47aa-b66a-52651ee51e62/zobidediz.pdf
    • https://uploads.strikinglycdn.com/files/44d68f4d-3afb-454c-b87e-5bf62915ac42/17855636756.pdf
    • https://uploads.strikinglycdn.com/files/1ae5a811-83cd-4e5b-9530-ee8737637e9b/stolen_lands_pathfinder_kingmaker.pdf
    • https://uploads.strikinglycdn.com/files/ec588506-20f6-4ea1-92f6-9dd4a2ebf589/zijes.pdf
    • https://uploads.strikinglycdn.com/files/df431d34-22e1-405d-a22c-3534238fd9b2/65240091369.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010929.bin
c10a878c69bba414c53e27cde36f1b4e5bb364995b07b69fb6daff2054317740		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10929 5052 bytes
font_01_sfnt_off00011a34.bin
7757025e3eb89192a6e66cf6e808c4d6c5315ce6388aad5e27230d6e61d8d2c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A34 10792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.