Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcc6d73d6b6ead56…

MALICIOUS

PDF

74.2 KB Created: 2021-02-20 22:49:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: c5c02e0e225fe08de1403fd107766532 SHA-1: 8118dae072da61df52787a1af3c41f6e415b89e6 SHA-256: bcc6d73d6b6ead56890a23454edabd68208ab00da50e703b7db2fb05cdc0e725
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to PDF files, suggesting a link farm or redirection mechanism. The ClamAV detection and ML classifier indicate malicious intent, specifically identified as phishing or a trojan. The document body, though heavily obfuscated, contains references to 'Suzuki cello book 1 slideshare' and 'wkhtmltopdf', which are likely lures to disguise the malicious nature of the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8947

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=suzuki+cello+book+1+slideshare PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4529024/normal_600142d5f0b4c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4410976/normal_5fe116250a10f.pdfIn PDF document text
    • https://cdn.sqhk.co/zimuteraf/bgagidV/woxeredasororelopadetipe.pdfIn PDF document text
    • http://topsalon.xyz/what_sd_card_for_zoom_h4n_proclkgu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392470/normal_601d718e79af0.pdfIn PDF document text
    • https://zugozoriv.weebly.com/uploads/1/3/4/7/134770463/vavupukuxir.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490380/normal_5ffdc56b6e3c5.pdfIn PDF document text
    • https://cdn.sqhk.co/totimujid/jcEAtge/us_stock_market_graph_2020.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485704/normal_600cc85fdd015.pdfIn PDF document text
    • https://cdn.sqhk.co/litalile/ejfdghw/powuguru.pdfIn PDF document text
    • https://cdn.sqhk.co/bawusipa/khgdhaA/free_gems_monster_legends_no_human_verification.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bejideba/77518892011.pdfIn PDF document text
    • https://s3.amazonaws.com/radubozufiwo/39427188928.pdfIn PDF document text
    • https://s3.amazonaws.com/vuliwisuwig/44897835553.pdfIn PDF document text
    • https://s3.amazonaws.com/jepavilutabilel/argentina_flag_hd_picture.pdfIn PDF document text
    • https://s3.amazonaws.com/wexoteluwag/73499830455.pdfIn PDF document text
    • https://s3.amazonaws.com/sesafefanulokam/75301256065.pdfIn PDF document text
    • https://s3.amazonaws.com/zurovajij/99554464337.pdfIn PDF document text
    • https://s3.amazonaws.com/xeroguru/libertango_guitar_violin_sheet_music.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd90.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD90 5436 bytes
SHA-256: 1b7b052142f9814ce12fb551735cefe1c637daf9f561dc9a33bd66c67553fef8

Open this report in the interactive analyzer, or submit your own file for analysis.