Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0a39df037a3a690…

MALICIOUS

PDF

84.5 KB Created: 2021-03-14 16:02:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7c2d22539783e865d6b8c4b3e58f4e0a SHA-1: 1ed29a4595753e17babea0f808395fcab07f2ea9 SHA-256: c0a39df037a3a6908920f3b572359960ff0954d3a03dcc76e0c882c78c5874f8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are disguised as academic or informational resources. The ClamAV detection and ML classifier strongly indicate malicious intent, likely for phishing or SEO link farming. No scripts were extracted, but the PDF structure itself facilitates the attack by hosting numerous URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=australian+english+vs+american+english+pdf
    • https://cdn.sqhk.co/mogizufofuj/gehiVE4/zonurumovawajelob.pdf
    • http://goshop32.site/pidisolitijo2esjs.pdf
    • http://storeeuro.info/flotec_booster_pump_installation879gm.pdf
    • http://changepass.online/739082873613074a.pdf
    • https://vozoduxi.weebly.com/uploads/1/3/2/8/132815828/naforudeto.pdf
    • http://vumonivaxozutod.mypressonline.com/mawejabamudobozepenu.pdf
    • https://tiwoboromezusud.weebly.com/uploads/1/3/0/8/130874009/kidamudobatop-kupujurowevof-witek.pdf
    • https://cdn.sqhk.co/filovixedalu/fhcjbRo/close_to_you_carpenters_sheet_music.pdf
    • https://mejapibidar.weebly.com/uploads/1/3/4/3/134315264/rugigaduwapu-fegoviduwixu-raguxeto-xigat.pdf
    • http://nanonewe.scienceontheweb.net/vafizujim.pdf
    • http://sellforce.ru/74673074898btth4.pdf
    • https://cdn.sqhk.co/rotusorukazi/ieghXjd/zijenetozuvejodizezalob.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://c7972686-9310-4d97-8ac3-15e828887225.filesusr.com/ugd/8a419d_122dfaf507cd44be92f04c400bc161e6.pdf?index=true
    • https://69cf8a46-0d3d-4b71-8fd1-93df925da18e.filesusr.com/ugd/e4064d_d4bc914c561f4784855d333947d486b5.pdf?index=true
    • http://kubowulurarekij.myartsonline.com/diablo_3_endgame_guide.pdf
    • https://201a0bc5-0eb3-4135-8969-828875a6b07d.filesusr.com/ugd/607883_fe4986fbe0f04c198150f6ea10389770.pdf?index=true
    • http://bolirazebaf.myartsonline.com/5th_grade_word_list.pdf
    • https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_987f6073e81b4c0a8bc1f51b765deb98.pdf?index=true
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_582e9428e94240cab57f83df9f94fd87.pdf?index=true
    • https://d102a0f2-001f-4998-bb0a-88ac30ac05b5.filesusr.com/ugd/771ea4_5e271087a7b84fd796413b7e993f8b48.pdf?index=true
    • https://b5d51143-f34a-4a4f-9265-6917490cb775.filesusr.com/ugd/9f69bd_315f4d192f594030a5140b5dcc9dc08d.pdf?index=true
    • https://fa3f2985-242d-4a4c-93c0-6adbfb259eaf.filesusr.com/ugd/8dbe7a_50827708bd764b92940dc142e4e4a08d.pdf?index=true
    • https://05491ccc-77c7-428b-9c25-74f2c6c50d4a.filesusr.com/ugd/d51d36_35a807034bcd4a598c61b0bdda800df2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc2c.bin
9625e7bdd38a9ca54b0609b6198323bcf433c7b413673689c808f45ef6478056		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC2C 5392 bytes
font_01_sfnt_off00010e56.bin
a3e577fd7420bd31228d5353a78f54971c8f8b997759ee155525b725ea5982e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E56 11132 bytes
font_02_sfnt_off0001344c.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1344C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.