Malicious PDF — malware analysis report

Static analysis result for SHA-256 c141a6a17c7e0fa6…

MALICIOUS

PDF

83.3 KB Created: 2021-04-12 17:06:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cb1bc723aa2d423de4c3aa951451a0f7 SHA-1: e3b1bd7c65811aaaeb7e0587e66ae6f0c0b90dc0 SHA-256: c141a6a17c7e0fa600fb1f10c2c3b3e4a29fcdf33e153cc676e9b0f1754d794d
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, and a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The embedded document body and heuristics suggest a lure to download content, likely malicious. The presence of numerous external URLs indicates an attempt to direct the user to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+to+get+power+of+attorney+over+a+parent+in+florida
    • https://cdn-cms.f-static.net/uploads/4369498/normal_5fe9377ce352a.pdf
    • https://cdn.sqhk.co/kugefiruxat/ghiASjg/the_walking_dead_season_1_game_pc_download.pdf
    • http://helplnstagramcontact6088756.com/508262184489ezti.pdf
    • https://cdn.sqhk.co/kewesowovim/hjdQQVw/ramijenufugexilujonax.pdf
    • https://cdn-cms.f-static.net/uploads/4413474/normal_6037c05c68293.pdf
    • https://static.s123-cdn-static.com/uploads/4475985/normal_5fce7b0b33bc4.pdf
    • https://cdn-cms.f-static.net/uploads/4496616/normal_601b4e17619a3.pdf
    • http://national-verifyteam.com/vurobeloz1it2o.pdf
    • https://cdn.sqhk.co/sanobude/79SOghY/17057569554.pdf
    • https://cdn.sqhk.co/tejosepu/jehche6/58625994514.pdf
    • https://zitipijasidigor.weebly.com/uploads/1/3/0/8/130874434/4201892.pdf
    • https://cdn.sqhk.co/vixuwegijelo/fhhbjex/my_android_bluetooth_won_t_turn_off.pdf
    • https://cdn.sqhk.co/pibexezases/iHy96hj/solar_system_facts_for_5th_graders.pdf
    • https://nufosizusom.weebly.com/uploads/1/3/4/6/134619592/xilamalesugirabexu.pdf
    • https://malegudupo.weebly.com/uploads/1/3/0/8/130813961/6589716.pdf
    • https://cdn.sqhk.co/sirejeforox/b29icii/zapavukefowuzupixarotu.pdf
    • http://eurosett.net/722469531794uoc6.pdf
    • http://theporte.xyz/refowonarujekunubixapari64g.pdf
    • https://static.s123-cdn-static.com/uploads/4462035/normal_5ff94ffd262e9.pdf
    • https://kagejiwuj.weebly.com/uploads/1/3/4/0/134095923/9d0b26b32ad.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bupulifiso.rf.gd/bird_photography_tips_and_techniques.pdf
    • http://nukisiboviwal.epizy.com/can_you_sue_a_contractor_for_not_finishing_work.pdf
    • http://dekutob.epizy.com/62283020216.pdf
    • http://rovututuxopi.epizy.com/64749252159.pdf
    • http://bofiragomux.rf.gd/13252199551.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f965.bin
2532bd766a8286be1e150a62b6e68d1afc699fe4ca448e6b72725750d3de87d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF965 5036 bytes
font_01_sfnt_off00010aae.bin
96c80a667500f413a040adbf61863e93e9e90655906d9ad85418c2ac112a3980		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AAE 10756 bytes
font_02_sfnt_off00012f31.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F31 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.