Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc60dc5d879c33e2…

MALICIOUS

PDF

74.0 KB Created: 2020-12-22 03:40:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e62b87fc2cec1ff854e1906ccee76d2a SHA-1: 72f4e60ba66ab542548091f66c5b03061209e6be SHA-256: bc60dc5d879c33e25668b3af8b72ff35701ad475a7a1ed26ee155b64fcad3ba9
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains heuristics indicating it is a phishing lure and a link farm, with one URL specifically mentioning 'qr code scanner free download for pc'. The presence of a QR code lure and a download button further supports a phishing or malware distribution attack pattern. ClamAV also detected this as 'Pdf.Phishing.Trojan'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 7

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=qr+code+scanner+free+download+for+pc
    • https://fabezetenonuke.weebly.com/uploads/1/3/4/8/134846610/2375917.pdf
    • https://xeseboda.weebly.com/uploads/1/3/4/3/134323550/4374237.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3535d62d-8ec8-47c9-86da-3199805f5067/google_personal_page.pdf
    • https://s3.amazonaws.com/zolerazowubow/aprender_ingles_app_android.pdf
    • https://static1.squarespace.com/static/5fc0e2740a2757459be2c9b8/t/5fc11c967acac6192ae869b6/1606491286578/44048839121.pdf
    • https://uploads.strikinglycdn.com/files/f14eac03-0885-449a-af01-4acd7ee957eb/lidedijuvabowizixijunat.pdf
    • https://s3.amazonaws.com/dogazisuze/sebeko.pdf
    • https://s3.amazonaws.com/ladiwuzetawedi/neet_2019_answer_key_allen.pdf
    • https://static1.squarespace.com/static/5fdd52f8c2d4633280e99069/t/5fddecd67185ee572d3a9316/1608379607003/xelekidedewazag.pdf
    • https://uploads.strikinglycdn.com/files/eea10538-bba3-4159-bb3b-d806c6244f0b/recessive_lethal_genes_examples.pdf
    • https://s3.amazonaws.com/jenisozazewubo/cisplatin_hydration_guidelines.pdf
    • https://s3.amazonaws.com/navoburarovada/53088627436.pdf
    • https://s3.amazonaws.com/pafiganovavi/83218801430.pdf
    • https://uploads.strikinglycdn.com/files/aa38cbe4-bf50-4172-9272-ba84df594a20/varadonotixexasogazidi.pdf
    • https://s3.amazonaws.com/dovulavavo/montgomery_wards_sewing_machine_manuals_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cefa.bin
02883c252a376321703659b2bff05a51f30d4588786e0a08f7d1028e227e49e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCEFA 5300 bytes
font_01_sfnt_off0000e129.bin
ed190b9e89249ba36cb1e97ed20986df96ba3c1e5a534cf2cdd834e89557c1ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE129 10400 bytes
font_02_sfnt_off000104c6.bin
622cb07e8d6879e8a2c5f5056651b359cefcc765ae973607c47d3406227e32d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104C6 16324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.