Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3d8bfda9cc3f823…

MALICIOUS

PDF

83.4 KB Created: 2021-03-16 19:38:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12c20898bcf641a2c29cf489d79278b0 SHA-1: ea947a9db50477b3c886448714a5d5b35cadd26d SHA-256: c3d8bfda9cc3f823d114fbebe52dbe1bfbf65a9b3c5c6cb5272be22c3793b836
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating maliciousness. The document contains a large number of external links, suggesting it is part of a link farm or phishing operation. The embedded URLs point to various PDF files hosted on different domains, likely serving as lures or redirects.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=related+rates+ap+calculus+bc+free+response
    • https://cdn.sqhk.co/tazakabebilo/MniaXcT/12924726738.pdf
    • https://cdn.sqhk.co/tokafumotebi/iRinjjg/51533457237.pdf
    • http://4gusevshop.website/22444539684q1kvl.pdf
    • https://bilujadaju.weebly.com/uploads/1/3/4/7/134772480/a206281e2.pdf
    • https://cdn.sqhk.co/xoxamomajil/igiiGgd/dabirorufirijebavazatevo.pdf
    • https://cdn.sqhk.co/bifugudawesu/STjfvvu/zovaj.pdf
    • https://cdn.sqhk.co/regisanozoxo/gijehKx/setiwezexegidamojofilu.pdf
    • http://excschool.ru/36432235550bt5ce.pdf
    • https://wifevotus.weebly.com/uploads/1/3/4/8/134897576/af89f3563.pdf
    • https://kazajiti.weebly.com/uploads/1/3/4/4/134456981/lulivawesuf_kimame.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://luvebex.rf.gd/rivadoxunomokem.pdf
    • https://1c514d3f-4aca-4c14-a2cc-94ef866bc6c7.filesusr.com/ugd/860217_a939aaeed05d4ec2a01f0c909e1ccfa1.pdf?index=true
    • http://jefesati.rf.gd/el_juego_de_la_viborita_que_come_manzanas.pdf
    • https://0ca3454e-05ac-49fc-8d00-644b1af7be3c.filesusr.com/ugd/8bf3fc_ee8ecc73812d4733becae5bc05f310cd.pdf?index=true
    • http://zudozam.epizy.com/vezaromupukobugegaki.pdf
    • https://87164119-88a6-4d6d-a72f-b109cf2d88b9.filesusr.com/ugd/bd0a66_da7d2ac83ec24154ab95ff92438134d5.pdf?index=true
    • https://9fb0fece-6c2a-4f8b-8ff1-5d9ea67f5ee7.filesusr.com/ugd/f6a907_92de808a02cc4855a1d6039eb0c431bc.pdf?index=true
    • http://zulonojaminipe.rf.gd/bidirectional_glenn_shunt.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd0d.bin
396a01cfa5915f76196c21355c831892f862f10c8e76dbcc2fbad634544115e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD0D 5296 bytes
font_01_sfnt_off0000ef14.bin
0907054bfcab28ab67f76b95545ca5563a4ab1583925d2f8483e53084b9b5641		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF14 4600 bytes
font_02_sfnt_off0001002b.bin
4b2cbafc76750803dd5d992ceafce5d1e42f05027ad868587939debf412aba99		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1002B 11916 bytes
font_03_sfnt_off000127a3.bin
5adc1e75491b5340c6d9f56727885441433d0f07c796d1502aeeabea21655b81		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127A3 16328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.