Malicious PDF — malware analysis report

Static analysis result for SHA-256 c431f12a23a7f29c…

MALICIOUS

PDF

87.5 KB Created: 2021-03-29 05:27:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2ec2962cd6863337d461bfeb2d03d50f SHA-1: a8515da8e722b0852442df277deecdafbc886e5a SHA-256: c431f12a23a7f29c0b1634913f135f5f2970694d9262c00fdabf36ff9adfc5e0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, characteristic of a link farm designed to improve search engine rankings for specific keywords. The presence of a ClamAV detection for 'Pdf.Phishing.Trojan' and a high ML classifier score strongly indicate malicious intent. The primary URL suggests a phishing or scam lure related to 'hooked on phonics pdf download'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=hooked+on+phonics+pdf+download
    • https://gebotela.weebly.com/uploads/1/3/4/3/134318039/7969976.pdf
    • http://werikipirojenob.scienceontheweb.net/vuwujujipufogunefi.pdf
    • https://cdn.sqhk.co/pigajifaw/gfAjbgi/castaways_rv_campground_ocean_city_md.pdf
    • https://cdn.sqhk.co/muvetowiripa/xTibhbL/63641033396.pdf
    • https://cdn.sqhk.co/zirigajer/Fngxjfb/55197950639.pdf
    • https://cdn.sqhk.co/buvaboda/g077hWd/batirozodotut.pdf
    • https://cdn.sqhk.co/zolilobup/R3ibMsB/happy_thanksgiving_break_images.pdf
    • https://cdn.sqhk.co/gufezitaxato/1ChjZbB/pentagon_shape_angles.pdf
    • https://cdn.sqhk.co/paparidew/jje3ENK/27123088874.pdf
    • http://jonebosu.mywebcommunity.org/gojezedesevegojiva.pdf
    • http://vifuwala.iblogger.org/how_do_i_connect_my_hp_deskjet_3050a_j611_series_to_wifi.pdf
    • http://busijizi.medianewsonline.com/administrao_oramentria_financeira_e_oramento_pblico_para_concursos.pdf
    • https://cdn.sqhk.co/rubekafux/gejcjfO/lighthouse_cafe_sanibel_reviews.pdf
    • http://punejew.mygamesonline.org/how_does_drinkwell_pet_fountain_work.pdf
    • https://nutevozugunejeb.weebly.com/uploads/1/3/1/4/131483143/tapubawatozi.pdf
    • https://cdn.sqhk.co/gobisofokox/jihbhjr/97295618074.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gujomodezeroj.epizy.com/lukebajadetoz.pdf
    • https://s3.amazonaws.com/befarekogol/why_did_my_songs_disappear_from_apple_music.pdf
    • http://zepedijuva.epizy.com/free_english_grammar_worksheet_for_grade_3.pdf
    • https://s3.amazonaws.com/norozovijalu/69223205952.pdf
    • http://vimixof.onlinewebshop.net/20360963849.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000117d9.bin
c916b24125a4144be9e18561309916c5229b2d91b44328caa5368ccab5cd2512		 pdf-font-stream PDF embedded font (sfnt) at offset 0x117D9 5264 bytes
font_01_sfnt_off000129db.bin
22bace2f5cda337dcd930bc9e7d05b92e6e73e63c488951a0de640be0781ef29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129DB 11444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.