Malicious PDF — malware analysis report

Static analysis result for SHA-256 caaa1fe4f2b3c0d6…

MALICIOUS

PDF

129.5 KB Created: 2021-03-14 11:30:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7145127fb025defa5ea1e7d3eb8724ef SHA-1: 238c6dc5e2e19b94a799046d6a7e7912bf723246 SHA-256: caaa1fe4f2b3c0d694ac45dd2478adcf7ccf4bbec31a38a3fbc591bd1c7ce22c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or malware distribution lure. It contains numerous external links, including a link farm, suggesting an attempt to redirect users to malicious sites. The document body, though heavily obfuscated, appears to reference 'Roblox shirt template 2019', a common lure for younger audiences. No scripts were extracted, but the PDF structure itself facilitates the embedding of malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=roblox+shirt+template+2019
    • https://cdn.sqhk.co/vafegijateno/Igishch/bixerov.pdf
    • http://frut-tree.site/deep_fitted_sheet_double_whiten6wxa.pdf
    • https://cdn.sqhk.co/fujotojaxob/gdScjbE/vasewevibitikotobo.pdf
    • http://flathead.us/zuxijitiqqig4.pdf
    • https://cdn.sqhk.co/lilaxikixo/1gihig8/two_player_games_free_download.pdf
    • https://vuwisirikufav.weebly.com/uploads/1/3/4/7/134765545/b878b40874.pdf
    • https://cdn.sqhk.co/sifolilo/haLgjja/mitazozexusifa.pdf
    • https://gajevorotaro.weebly.com/uploads/1/3/5/3/135329880/nagokupofebi_numazasi_rixarufurofute.pdf
    • https://zelelifejoba.weebly.com/uploads/1/3/4/3/134321633/5467846.pdf
    • http://giveaway2020.info/capitulo_1b-_9_realidades_2_answersi1hg3.pdf
    • https://dosolixegu.weebly.com/uploads/1/3/4/3/134340741/denoxoz.pdf
    • https://cdn.sqhk.co/pigajifaw/geQhajb/saburane.pdf
    • https://fenipedixov.weebly.com/uploads/1/3/5/3/135385823/6322725.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/65977748-5ecd-4a8d-bd72-096f23e6e799/malibu_low_voltage_transformer_200_watts.pdf
    • https://uploads.strikinglycdn.com/files/c59b143d-b29e-422b-8478-1b9fcaf439d5/what_does_postage_due_unit_mean.pdf
    • http://jewofeket.onlinewebshop.net/fridge_leaking_water_inside_frigidaire.pdf
    • https://uploads.strikinglycdn.com/files/059906d9-60c1-494b-9c7c-0a346c5df90d/movuxawakixireged.pdf
    • http://mobukug.myartsonline.com/tawitet.pdf
    • http://nuzikenevizut.onlinewebshop.net/he_comes_next_review.pdf
    • http://desovizipelo.onlinewebshop.net/annexes_icao.pdf
    • https://uploads.strikinglycdn.com/files/b7debfb2-8cb7-47e4-b95a-ee8bfbf764fc/kitchenaid_pro_600_series_lift-bowl_stand_mixer_-_6_qt_-_575-watt_-_silver.pdf
    • http://weparaxopulo.atwebpages.com/jesujelodafozeloxabidu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001ae44.bin
796d0a58db9c2da9757ac0440a9752fa2ee7f69e1b5440f7b7acad3fdf80fb76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1AE44 5440 bytes
font_01_sfnt_off0001c0b4.bin
40007a77e3e62850558c8c700b1363d6d5be0ae6fffa06c2b4b141136c5a11ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C0B4 13044 bytes
font_02_sfnt_off0001eaca.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1EACA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.