Malicious PDF — malware analysis report

Static analysis result for SHA-256 b937c577acb86fe8…

MALICIOUS

PDF

86.1 KB Created: 2021-04-09 02:00:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e5cf7b5c2787a8d71e3433c2b67aa925 SHA-1: 74e5ea52ba477a0914bad41a19cb45505a14b6bd SHA-256: b937c577acb86fe8ea4ddebed34c248a9dee3a5a8c3d15bde60ccfdc5d662cbe
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a mass external link farm, with one primary URL pointing to a phishing site. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it is designed to redirect users to malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=psalm+23+new+international+reader%2527s+version
    • https://cdn-cms.f-static.net/uploads/4424007/normal_603c075221e2f.pdf
    • https://static.s123-cdn-static.com/uploads/4443594/normal_5fcf76f5a79f7.pdf
    • https://cdn-cms.f-static.net/uploads/4418365/normal_606e7dcfca5b7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ed59cdd8-0d75-4634-8bb2-7afdb9da103e.filesusr.com/ugd/9cb112_d9f0c6d771004bd8a5affe31f4b78753.pdf?index=true
    • https://8c77b9b7-c39b-43d6-9406-6086bd2c0f93.filesusr.com/ugd/ee6770_8702fe89b8744fd1ba8b4953ed83548b.pdf?index=true
    • https://6ec3981f-6443-463b-a164-91fc69f101d9.filesusr.com/ugd/7603ae_8c2f691c415142e3ada4ca68dae41d32.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1377f533-b3a0-4b14-af68-5ec6f2e0a693/little_house_on_the_prairie_season_dvds.pdf
    • http://ganusigesu.rf.gd/revolt_against_the_modern_world_julius_evola.pdf
    • http://zonatitusajobo.onlinewebshop.net/sukexovinofusavadog.pdf
    • https://uploads.strikinglycdn.com/files/019c3f23-bd77-432e-8e44-e7781e5f4ccf/14731456543.pdf
    • https://e9155d39-0f7d-4366-9ee8-34e17fe3d773.filesusr.com/ugd/9e05b8_a5da9a027e93407b94bf2dade0fe74c9.pdf?index=true
    • https://3c1efe6f-6e34-41bb-a2c4-2be85dd3cb33.filesusr.com/ugd/41f880_8754c6920484436f9bbcc4365df4917a.pdf?index=true
    • http://zexuxogawozujiz.rf.gd/1853915764.pdf
    • https://uploads.strikinglycdn.com/files/ca24abb3-6710-4bac-b49c-f6bedb3813bd/76658311034.pdf
    • https://51956041-da35-40aa-96c1-085c1f47c80d.filesusr.com/ugd/e6e573_f42012313d0b4811889a8a24e4585938.pdf?index=true
    • http://kisolapuri.rf.gd/xawijibunegomanobero.pdf
    • https://0ca3454e-05ac-49fc-8d00-644b1af7be3c.filesusr.com/ugd/8bf3fc_6a1fe360491646ab891c6446526b3026.pdf?index=true
    • http://tosipasakuvil.myartsonline.com/hypoglycemic_encephalopathy.pdf
    • https://uploads.strikinglycdn.com/files/690d22bc-a9ba-497c-a3fa-1b8a621b796c/rovudupataf.pdf
    • https://176fe727-baa2-4f6f-8ab0-cddcd97ecb74.filesusr.com/ugd/45df28_cd027ddf35e54fa480e22cad49f59062.pdf?index=true
    • https://uploads.strikinglycdn.com/files/564530e5-872c-4c90-b405-6b0c8589c471/vinarumizitipefamomore.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000111b9.bin
99e574d17ae6ec7bc8a77f02d0d8ef1f1dfdf15e0a1f16ac27b039c948530b1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111B9 5452 bytes
font_01_sfnt_off0001244d.bin
e0df6a52beb9c697ac0c22aae6412c35165b3f352e8825b04b72b2d02a5beb18		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1244D 11852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.