Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5df951f59885581…

MALICIOUS

PDF

77.5 KB Created: 2021-03-20 06:38:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 53a573fe7939cada18a043602e3ccb10 SHA-1: 4c1a10667e7e67c507626847049cfcf0c36965a4 SHA-256: c5df951f59885581aca9a394a8331a7e1dc53a09824b85b5c582ed96ca0e859b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, with one prominent URL pointing to a suspicious domain. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic suggest an attempt to redirect users to potentially harmful content or engage in SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=mike%2527s+huli+chicken+oahu+hawaii PDF link annotation
    • http://zememor.sportsontheweb.net/archipelago_definition.pdfIn PDF document text
    • http://consumer-data-protection-bureau.com/haier_chest_freezer_replacement_parts1996t.pdfIn PDF document text
    • http://pusewuvi.medianewsonline.com/pandoc_html_to_page_break.pdfIn PDF document text
    • http://yatvoyya.fun/how_to_apply_for_2_year_old_childcare_funding7kptr.pdfIn PDF document text
    • http://magazok.top/muvijiniwc6iq.pdfIn PDF document text
    • http://silkhfig.bid/how_to_smoke_prime_rib_in_a_masterbuilt_electric_smokerfpjhn.pdfIn PDF document text
    • http://idslim-italia.site/29835001950n4q7u.pdfIn PDF document text
    • http://whitetwo.space/muxitotoeq9.pdfIn PDF document text
    • http://tiwujatujoput.mygamesonline.org/ayushman_bharat_yojana_in_kannada.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nufidibodudulad/rose_gold_platform_high_heels.pdfIn PDF document text
    • https://s3.amazonaws.com/bulozor/54402366865.pdfIn PDF document text
    • https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_697230d0e13e4be6bc6c6a669f40b46b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a423c596-1ae0-4449-8ae7-ec4f8b5d557b/gepur.pdfIn PDF document text
    • https://s3.amazonaws.com/mejigavukolu/nikuwuzel.pdfIn PDF document text
    • https://s3.amazonaws.com/fizufapu/piriformis_ultrasound_guided_injection.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/299704d7-a7bb-4dc6-8b7d-119dc91ab185/omron_pedometer_reviews_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17108e44-7093-4ca8-951c-7ff2142a0cd5/kixosimerafaxan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/024913b3-7974-42b8-b544-13b89fba8a66/modal_auxiliary_verbs_exercises.pdfIn PDF document text
    • https://9f5bcc56-a059-4f00-ae85-604acd6a3d2d.filesusr.com/ugd/ac9354_9060420c2b014bd6ad79f68ff91c1890.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/65c3e853-6b09-454c-8166-dae511f5b31d/how_to_use_plantronics_explorer_500.pdfIn PDF document text
    • https://4900ecec-7ac1-411c-be2c-b077674085c8.filesusr.com/ugd/493135_34aec0300026418584aab5ece714e522.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zeworibuzoza/xopetiganirakipogujala.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF17 4988 bytes
SHA-256: 4f2a039b093bca18f044fc48742e26e92401ca40fe47aba7ad9a3f690116fec5
font_01_sfnt_off00010036.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10036 11432 bytes
SHA-256: 0c8cc1e483714a03ac190571fd91f3838cd6b2292bbda240855016a7df6e17cd

Open this report in the interactive analyzer, or submit your own file for analysis.