Malicious PDF — malware analysis report

Static analysis result for SHA-256 c00204abff5657e7…

MALICIOUS

PDF

74.5 KB Created: 2021-04-01 07:56:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9836b1dad0323ba21a59a729995b384c SHA-1: ee1ab0d8722ac3460f39ab6da95395433f7a63eb SHA-256: c00204abff5657e70cdb684068b7ac1336bb700b98f1cdbd3f4063e3659fcd85
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document exhibits characteristics of a phishing or malware distribution lure, evidenced by the 'PDF_SEO_LINK_FARM' heuristic indicating a large number of external links, likely for SEO manipulation or to host malicious content. The presence of a download button lure and ClamAV detection further supports a malicious classification. The document's structure and embedded URLs suggest an attempt to trick users into downloading a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=bharathidasan+university+ma+english+syllabus+pdf
    • https://betetaguzom.weebly.com/uploads/1/3/2/3/132303315/8302634.pdf
    • https://cdn.sqhk.co/kovixileta/UcZvRhj/66142187591.pdf
    • https://gedofulijul.weebly.com/uploads/1/3/0/7/130775434/958171.pdf
    • http://tujofifebituxuv.22web.org/75514497970.pdf
    • http://xopijodujakik.22web.org/auxiliary_verbs_download.pdf
    • https://sukuwakutas.weebly.com/uploads/1/3/4/6/134603616/68242ce.pdf
    • https://mosugomepa.weebly.com/uploads/1/3/4/0/134096926/xujegokopamilonil.pdf
    • https://vijopafixav.weebly.com/uploads/1/3/1/6/131636601/refibono-voximidonu.pdf
    • https://cdn.sqhk.co/wadalibituge/YAhgWge/memobagoto.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6be87b7c-cbbe-45fb-8eb7-fab174759916/15121299445.pdf
    • https://uploads.strikinglycdn.com/files/2e388b2b-642b-409e-b09c-b567c65af64a/7053012315.pdf
    • https://uploads.strikinglycdn.com/files/af4cca74-680e-4e21-a885-1e9c354b7bc8/mirro_rubber_pressure_canner_gasket_12-22_qt._black.pdf
    • https://uploads.strikinglycdn.com/files/11a53834-4e7a-4bfd-b555-2c8fee1da2cd/28345967351.pdf
    • http://bokakemipik.epizy.com/how_to_use_textured_paint_on_ceiling.pdf
    • http://zorumiwopa.rf.gd/lalakajodapites.pdf
    • http://mikotavorekibe.rf.gd/learn_korean_with_bts_book_price_in_india.pdf
    • http://petetilazuji.epizy.com/fauquier_sheriff_daily_report.pdf
    • http://galexuduxegi.epizy.com/guidelines_management_of_hypertrophic_cardiomyopathy.pdf
    • https://uploads.strikinglycdn.com/files/5940a941-d366-4261-88dd-3cc4b7fc7096/very_short_stories_in_telugu_to_write.pdf
    • https://uploads.strikinglycdn.com/files/62cb92c7-1788-467d-a6dc-be80bc85cda8/nowoxewuwanopinebe.pdf
    • https://uploads.strikinglycdn.com/files/a3ab8966-365a-4d9c-95de-7fe2a172fa9d/55454965940.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1f9.bin
4c36c31f0397a9969aa55492dfa214aa034490dcecb3d352f1fc02a41516bf37		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1F9 5804 bytes
font_01_sfnt_off0000f59c.bin
4600564547bdb3d99f9c24264e7b68754386d205947396d3af86782f6ca86a3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF59C 10928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.