Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad65973143221d93…

MALICIOUS

PDF

115.5 KB Created: 2021-05-07 09:28:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f78e548e2017ee491959c07f0da9521f SHA-1: 1c487e6523c6e73e58f4a95b2f555d89142b2227 SHA-256: ad65973143221d939fd39635e0a3a974e632a8444f5ca36df75960579b4409bb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are obfuscated or point to potentially malicious domains, indicating a link farm or phishing lure. The ClamAV detection and ML classifier strongly suggest malicious intent, likely to redirect users to a malicious site for further exploitation or credential harvesting. No scripts were extracted, but the PDF structure itself is indicative of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=emdr+scripted+protocol+for+ocd
    • https://cdn.sqhk.co/wixexozesila/25ghFjb/samsung_notes_not_working_on_huawei.pdf
    • http://tasefuvakol.22web.org/checkmarx_plugin_for_intellij.pdf
    • https://cdn.sqhk.co/gipagigo/g8HzWKM/zijonubadopowax.pdf
    • https://cdn.sqhk.co/fuxiwimemo/ieifheg/super_smash_bros_bomberman.pdf
    • http://wapajojakazewi.iblogger.org/53401684857.pdf
    • https://rewegabelera.weebly.com/uploads/1/3/5/3/135390500/wapiwugiwofilekov.pdf
    • https://kowelisabames.weebly.com/uploads/1/3/1/8/131857626/dovajux-nefutoxawu-xololuwupog-supumusofetow.pdf
    • https://dekudabor.weebly.com/uploads/1/3/4/8/134893804/b26e58611b89c.pdf
    • http://sanadewa.iblogger.org/vibizolinuv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f64a1a0a-debf-4843-a838-a34c0cae0f4a.filesusr.com/ugd/89602e_1c0fb52537164ee486ff214d0002fc10.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ca46521c-a039-4e3c-80f8-46c6564f5951/xelosabalofuzin.pdf
    • https://1c985592-4fe2-425a-b8d2-7dc24782370c.filesusr.com/ugd/a13bc2_f392a403dec74cd3961a1332056bae0b.pdf?index=true
    • https://413f70bc-0247-4a04-a3fc-eabb14e2b93f.filesusr.com/ugd/f18ee6_87144950103d4e56bb769a7404aebc9f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/270b82f7-eda7-4852-bc7d-69724c2ac2ea/65283881301.pdf
    • https://ef90beaa-bca2-431e-862c-49c19dd94618.filesusr.com/ugd/06497e_be0ac22476df40d58d330c13eba675a6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3c303e97-92bc-4717-84ea-606f69406c2c/what_did_the_clergy_want_in_the_french_revolution.pdf
    • https://uploads.strikinglycdn.com/files/ed65d3af-d7c3-489a-beb2-3f055e583dbf/air_force_one_love_letter.pdf
    • https://645c32c3-7e99-4959-b93b-7980205539d7.filesusr.com/ugd/30a31c_bbb61e5b2a9e46dca00c49832d37e45b.pdf?index=true
    • https://fb9345b8-40be-4608-a8ff-9c5427dba92f.filesusr.com/ugd/98d639_0d08495578e84489ac5a8110bed55470.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9692525e-f64c-4dd9-a319-a2ac7e327b9a/nixixotunibif.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000188d8.bin
bdca3f278267435e9dde6c7032e4795e2e96919351a421fb4d17cc44652b06dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x188D8 5048 bytes
font_01_sfnt_off000199f7.bin
3f8f581b4342178b279d74b1f37ac884a79d09d075bcab2c3233b56d9a62d341		 pdf-font-stream PDF embedded font (sfnt) at offset 0x199F7 11320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.