Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1ee5b2881d29be1…

MALICIOUS

PDF

70.3 KB Created: 2021-02-15 02:23:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04
MD5: aa8cff357f5bd728338f9f70398ca1cb SHA-1: 1ecb8f2156b22aab6d386c7734330805e72e4887 SHA-256: b1ee5b2881d29be1ba5dfd934bf8f13067bbbb2b75f615aacec184edb67e0b10
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are disguised as book-related content, indicating a potential link farm or phishing lure. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and numerous external links suggest an attempt to redirect users to malicious sites, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=twisted+book+synopsis PDF link annotation
    • https://cdn.sqhk.co/kagurase/2XjdO28/dragons_riders_of_berk_wiki.pdfIn PDF document text
    • https://cdn.sqhk.co/zedawuzijis/hajbhD7/18388049962.pdfIn PDF document text
    • https://cdn.sqhk.co/vulovosovem/cjdk96J/need_for_speed_most_wanted_2005_apkpure.pdfIn PDF document text
    • https://cdn.sqhk.co/tesolivu/2hcJQTW/38936955059.pdfIn PDF document text
    • https://vutubazedo.weebly.com/uploads/1/3/2/7/132740780/5412604.pdfIn PDF document text
    • https://cdn.sqhk.co/pibexezases/joYUcii/download_weather_clock_widget_android.pdfIn PDF document text
    • https://cdn.sqhk.co/xifusajexom/jjFhfij/download_crowd_clash.pdfIn PDF document text
    • https://cdn.sqhk.co/ropobemuma/beXF3M2/pop_music_playlist.pdfIn PDF document text
    • https://cdn.sqhk.co/toromerepowa/3gjjzFz/n64_emulator_android_download.pdfIn PDF document text
    • https://cdn.sqhk.co/zugeketinog/4lGgHxE/52980872176.pdfIn PDF document text
    • https://cdn.sqhk.co/fivufotimad/je5hchi/kodi_builds_october_2020.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453747/normal_5fe0a41340577.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459036/normal_5fc5f7bdcf2a0.pdfIn PDF document text
    • https://cdn.sqhk.co/noluxokeruma/jepPQNl/71879391911.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rowebilit.epizy.com/brightwell_navigator_app.pdfIn PDF document text
    • http://sekovukubetib.epizy.com/wegoxororuzunuradunabigu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000daa4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAA4 4960 bytes
SHA-256: 4df856f69e0ad1c78ecb4caff80fcea6e21e17358675507f64174479e1c12e86
font_01_sfnt_off0000ebb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBB1 9716 bytes
SHA-256: 0df400f0328f561df343f7e127b72c7fa28a405179210e9bb77afc9c62f8e76d

Open this report in the interactive analyzer, or submit your own file for analysis.