Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4d9e1d24966cb4c…

MALICIOUS

PDF

82.6 KB Created: 2021-04-03 11:43:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 34eb85af2e6c944b00b047c6691b20b9 SHA-1: 7e2d7f679e7b2b580f2c237f76b1b6ec33ff113e SHA-256: c4d9e1d24966cb4c0cdba543eadaddf947299051223aba0f7cbe43d3f7f07d8e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for link farms or phishing campaigns. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and extensive URL usage suggest it's designed to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/aws?utm_term=what+does+29+x+30+mean+in+jeans PDF link annotation
    • https://gefivepuli.weebly.com/uploads/1/3/4/6/134620723/bebefu_dimadakuxifeb_vobexunel_gezigufaragujaf.pdfIn PDF document text
    • https://xudapunazegiwav.weebly.com/uploads/1/3/2/7/132741045/6478041.pdfIn PDF document text
    • https://muduvikude.weebly.com/uploads/1/3/4/4/134483108/7817299.pdfIn PDF document text
    • https://dafizigupiteg.weebly.com/uploads/1/3/4/4/134492389/9859701.pdfIn PDF document text
    • https://xazulifego.weebly.com/uploads/1/3/4/7/134727283/8508392.pdfIn PDF document text
    • https://paxiguvemogi.weebly.com/uploads/1/3/4/3/134317910/xixoneri.pdfIn PDF document text
    • https://lolorude.weebly.com/uploads/1/3/0/7/130775760/kamigizivulake.pdfIn PDF document text
    • https://rejasujewefem.weebly.com/uploads/1/3/0/7/130738882/baxusulijogori.pdfIn PDF document text
    • https://juxusuvib.weebly.com/uploads/1/3/0/7/130739690/vujuv.pdfIn PDF document text
    • http://pulezuxelad.22web.org/all_movies_apk_for_android.pdfIn PDF document text
    • https://kajizifobizixa.weebly.com/uploads/1/3/3/9/133997117/nokulada_nibevilavexij.pdfIn PDF document text
    • https://wodekatim.weebly.com/uploads/1/3/1/4/131405934/rajeberigogisu.pdfIn PDF document text
    • http://gawivekarebuvus.22web.org/segijisudu.pdfIn PDF document text
    • https://burevojaziji.weebly.com/uploads/1/3/4/7/134729690/4691668.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fac7854b-22c3-40b9-bef9-ee94a55a010d.filesusr.com/ugd/fba82c_8f3116147a65441d87346355992f8886.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/novifamigot/flicks_hairdressers_guide_bridge.pdfIn PDF document text
    • https://s3.amazonaws.com/davubewu/menuxaxutebetikepegapopuv.pdfIn PDF document text
    • http://zexukojol.rf.gd/72944252639.pdfIn PDF document text
    • https://s3.amazonaws.com/vasofirida/rovalawopimus.pdfIn PDF document text
    • https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_5a652fe661fc441d9523ecdd0d473e17.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jasadavebaga/sevesidipaso.pdfIn PDF document text
    • https://827a6da4-a69c-4806-aaaa-db522494bc4d.filesusr.com/ugd/cb5916_d14f70d91ae2497697fcb12e926ab9f9.pdf?index=trueIn PDF document text
    • https://b6de9e3f-c562-4e05-b5ee-70895c8060ae.filesusr.com/ugd/3801ff_1e859947c40b49ed962648811aa475d1.pdf?index=trueIn PDF document text
    • http://losalevova.epizy.com/monakarusifi.pdfIn PDF document text
    • https://s3.amazonaws.com/donarepemi/jalesexigibeba.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f75e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF75E 2900 bytes
SHA-256: 40ce0bc9b113ef031639604f059b60aa9f1e41b097d60e75bfbf620cccc66306
font_01_sfnt_off000101a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101A2 5688 bytes
SHA-256: f15e83ed6831dae8eefeff9e532dc586db83f4cf01730cae78ce64e51c451baf
font_02_sfnt_off000114df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114DF 10956 bytes
SHA-256: 75b3d8e9ad83b584834ff0de395a21fe7e669394345135082067fe8b85f25c77

Open this report in the interactive analyzer, or submit your own file for analysis.