Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad7ee66e8afea994…

MALICIOUS

PDF

74.5 KB Created: 2021-03-25 01:01:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 52a38b3ca2471ed128b18e0e1de502c0 SHA-1: dbeae8ab45a718e023f18f6ab399300fad22a86f SHA-256: ad7ee66e8afea9946cd82b220000f4a7d51ebb186a8cc39aa8090663c7387d60
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The presence of a PDF link farm and embedded URLs suggests an attempt to direct users to malicious or deceptive content. While no scripts were explicitly extracted, the PDF structure and link farm indicate a phishing or malware distribution attempt, likely delivered as an attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=parker+pneumatic+solenoid+valve+pdf
    • https://cdn.sqhk.co/nudadubuju/ojenKgd/kuvew.pdf
    • https://cdn.sqhk.co/vivepovugeli/hihg8so/10277113655.pdf
    • http://xibawolafubiz.getenjoyment.net/fujitsu_scansnap_s1500_setup_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ee6e56e8-c390-49d2-810b-d4defef8b9c1.filesusr.com/ugd/eda187_2e8ca927d00f4fc2a679e2a364778b91.pdf?index=true
    • https://s3.amazonaws.com/gozilum/cover_letter_latex_templates.pdf
    • https://s3.amazonaws.com/banula/mr._coffee_iced_coffee_maker_instructions.pdf
    • https://ca108e69-7b6b-43f0-8f16-d96ebeb8a33d.filesusr.com/ugd/79e0dc_aefc3027a8d64d1996484545cc79984e.pdf?index=true
    • http://wufejupixixot.epizy.com/how_do_you_start_a_bosch_500_series_dishwasher.pdf
    • https://s3.amazonaws.com/fajetufekejo/fun_games_for_couples_android.pdf
    • https://uploads.strikinglycdn.com/files/05aadedd-e951-4146-a99e-00c19fd9dde0/88381082669.pdf
    • https://uploads.strikinglycdn.com/files/7ec3031a-627a-4ded-9f20-aa2232d6de5b/books_similar_to_the_dark_tower_series.pdf
    • https://s3.amazonaws.com/garorowa/html_form_templates_using_javascript.pdf
    • https://75ca6b5e-a470-4e0e-8004-b00a9f1721b4.filesusr.com/ugd/1e4819_b94e7c898b5a40f69fca139153154c74.pdf?index=true
    • http://xiwozoget.atwebpages.com/atonia_uterina_tratamento.pdf
    • https://uploads.strikinglycdn.com/files/cfd0c6f4-34fd-495d-8641-98010a32181b/zovaladekiwixikaxaritewaz.pdf
    • http://vojuzegi.epizy.com/betufudikurujalabiku.pdf
    • http://tegumebedizeso.epizy.com/16925478016.pdf
    • http://tezafafowajij.epizy.com/94835062481.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4ae.bin
b7bdfb74156ffac262436cbb99a096b17d30e44f66f55398a6ba83e82a1edc0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4AE 5424 bytes
font_01_sfnt_off0000f717.bin
401598804131b9f0dcd3ea66319d1b19db1beeba4d7f548e0f09eb6de4510504		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF717 11048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.