Malicious PDF — malware analysis report

Static analysis result for SHA-256 b29eca45997c7b12…

MALICIOUS

PDF

87.7 KB Created: 2021-05-22 02:55:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b9daa48f4e172546726db8ee54a95455 SHA-1: d2a9c4c0fc8dc8da5e994bc1d25fc7c381d811e0 SHA-256: b29eca45997c7b1207c82d84a4494bb404f5b1016fd2dc57af531ecb1431d1ef
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to other PDFs, suggesting a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. No scripts were extracted, but the PDF structure itself is designed to redirect users to potentially harmful external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=how+hard+is+it+to+take+care+of+a+blue+tongue+skink
    • https://zimiposix.weebly.com/uploads/1/3/4/6/134690331/kelozivuwuxetimibo.pdf
    • https://xopomosafeg.weebly.com/uploads/1/3/4/7/134732974/nutagowonozoto-mifokixesekutot-sewedat.pdf
    • https://static.s123-cdn-static.com/uploads/4377120/normal_60060fb69bdc4.pdf
    • https://cdn-cms.f-static.net/uploads/4371244/normal_60442fd7b0ee2.pdf
    • https://static.s123-cdn-static.com/uploads/4456389/normal_5fcb922d19a37.pdf
    • https://levevuwakute.weebly.com/uploads/1/3/4/9/134904524/siwipafunoxivapu.pdf
    • https://static.s123-cdn-static.com/uploads/4450257/normal_5ffa5f6bca7d0.pdf
    • https://dezusopivelisuk.weebly.com/uploads/1/3/4/7/134734284/4656372.pdf
    • https://vixekilawuta.weebly.com/uploads/1/3/4/3/134305586/lewawivejezudinexes.pdf
    • https://memapuzubabevu.weebly.com/uploads/1/3/0/8/130813849/7354299.pdf
    • https://gadolelexuzited.weebly.com/uploads/1/3/4/4/134486477/7b2135.pdf
    • https://cdn-cms.f-static.net/uploads/4444370/normal_6024aa51624ef.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c043ed5c-7a83-4998-a9e8-7ae31e53b7dc/can_i_take_a_day_off_work_for_stress.pdf
    • https://uploads.strikinglycdn.com/files/d2871ff0-06ea-4856-a999-910b52b52a84/wugabuzarunamidegekeduxon.pdf
    • https://uploads.strikinglycdn.com/files/65d920aa-fce0-4c36-839b-8fc728bea786/zulab.pdf
    • https://uploads.strikinglycdn.com/files/d8fdda58-659e-491d-af35-89633c4bfde6/what_is_the_most_important_era_in_history.pdf
    • https://uploads.strikinglycdn.com/files/769a6511-1a71-4ba0-8383-d8b590c00b38/55877929303.pdf
    • https://uploads.strikinglycdn.com/files/2d630f1c-c239-471b-a188-6d727c29b843/tufipidazuzika.pdf
    • https://uploads.strikinglycdn.com/files/a455a0e7-6c5b-4acd-a025-5d0088f2010c/example_of_comparative_research_question.pdf
    • https://uploads.strikinglycdn.com/files/ad7affb3-1832-4b7d-a9bd-aac3eb31d846/php_mysql_website_examples.pdf
    • https://uploads.strikinglycdn.com/files/5474497c-b763-4fb4-8ea5-f6041d1e5816/kivufuludelutememobe.pdf
    • https://uploads.strikinglycdn.com/files/3237d28f-de0b-4d28-b439-a4b736322c12/what_is_the_purpose_of_six_sigma_methodology.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101d1.bin
98a64b0faf673ed696d1f5dbc4705ed6731aa3bcabe72971074e855097f8914a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101D1 5540 bytes
font_01_sfnt_off000114b5.bin
35e5e68731e268cab6297fd02781174c4e0793d35c481ff22c10560ae0693ab6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114B5 11360 bytes
font_02_sfnt_off00013b9a.bin
caac5f4713460bb22cd97ade6dcd74c4dded55c80dd1225a93128929eb95e3ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B9A 16184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.