Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad9d0733b9d2c8c7…

MALICIOUS

PDF

79.5 KB Created: 2021-03-30 12:14:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 82dbf7474e4fa46057f4fa85cfa9cc4d SHA-1: b16f1e7f5529c3f349971bb1907c528c0f9e5c18 SHA-256: ad9d0733b9d2c8c7fbda371374d49f3031cbe6c51abd00d443a86a215304874c
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains numerous external links, with a critical heuristic indicating a link farm designed to host malicious content. The 'SE_INVOICE_LURE' heuristic suggests a social engineering pretext. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to deliver a second-stage payload via the linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=ariesms+zero+guide
    • http://blancer.xyz/perefiiwk64.pdf
    • http://servicesforsupport.com/nucleo-f103rb_user_manualnboro.pdf
    • http://tells.fun/meepo_city_rider_2_for_sale7nw7a.pdf
    • http://com-copyrighit.com/zinelefajudukuvitiva37np8.pdf
    • http://verifiedbadge-lnstagram.com/knights_of_labor_definition_apushsiaju.pdf
    • http://idealicait.site/9203719240z2eqi.pdf
    • http://telemprom.xyz/appvalley_for_ios_7on5y4.pdf
    • http://leon-stavki.info/que_tipo_de_te_puedo_tomar_embarazadalkp29.pdf
    • http://kapusta.pro/periodic_table_igcse_noteswkhvn.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/484b5885-6ca9-4e1c-8f46-6494ff73f202/61587164776.pdf
    • https://s3.amazonaws.com/silubebebefuju/download_juz_30_imam_sudais.pdf
    • https://s3.amazonaws.com/dumupa/front_load_washer_will_not_drain_water.pdf
    • https://s3.amazonaws.com/lodazojamuva/bose_quietcomfort_20_in-_ear-_kopfhrer_android.pdf
    • https://uploads.strikinglycdn.com/files/016cf206-4527-42ec-9095-b91285acab46/kujubulodejufegujeji.pdf
    • https://uploads.strikinglycdn.com/files/48f754f6-b1e7-44b3-b08f-fcee502f6dc0/rutibat.pdf
    • https://uploads.strikinglycdn.com/files/4b6fcb7e-f502-4804-b565-da9fa0c0342c/49779633127.pdf
    • https://s3.amazonaws.com/fekaduvopigab/cyberflix_tv_firestick.pdf
    • https://s3.amazonaws.com/bifamomove/google_analytics_exam_study_guide.pdf
    • https://fa90eb46-aa9b-4fd1-a2e8-e903ec8e50a4.filesusr.com/ugd/575fb0_757db22649e3483e976709fb262766cc.pdf?index=true
    • https://s3.amazonaws.com/bulalowisu/sinodedek.pdf
    • https://s3.amazonaws.com/papuja/44377772504.pdf
    • https://uploads.strikinglycdn.com/files/f2deee82-4192-4729-bdeb-a6412ed64b6b/tabela_fipe_carros_usados_volkswagen_up.pdf
    • https://s3.amazonaws.com/vonutavekip/maruribalarakagewo.pdf
    • https://91c7bc9f-df77-4dbd-ae51-8bcf521f3e61.filesusr.com/ugd/1df9ea_85836229ba38407eafea7b8a16fdccdb.pdf?index=true
    • https://a804c8a8-fdf7-4fba-b19b-c23aecc29597.filesusr.com/ugd/a7074a_bbeedf3ff2684912850dbc860b9c1491.pdf?index=true
    • https://109d6476-c6f4-4eee-b84c-907698fb4207.filesusr.com/ugd/0d7ebf_33ac7a8f6b034d9493c4ef0e6be5019d.pdf?index=true
    • https://d5e9a058-cbdc-4968-ba72-30cdbf1e36a3.filesusr.com/ugd/9cfd0a_24b2b95558ed447a98d3f29168592146.pdf?index=true
    • https://s3.amazonaws.com/jefazaxal/list_of_android_games_with_keyboard_support.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f846.bin
2e6d69633941d1b1f63987408a8769e3643a3a0f84f632bb9f3ad6a504ec2ae9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF846 4944 bytes
font_01_sfnt_off0001090a.bin
460e654664e32f89b64207650f9cf41ff179d7459d5ca6779ca9348ee09cab43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1090A 11236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.