Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb4606bcc3106dab…

MALICIOUS

PDF

87.2 KB Created: 2021-04-13 15:57:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 6d1abda6ac310c52e225cc0d5472c160 SHA-1: 2726a3045ba3790cc08be86dcbdec685087d2b89 SHA-256: cb4606bcc3106dab9f59279d2e6e1c7c573f3dbf7011333eeee49354bf1ac516
246 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan distribution attempt. It contains numerous external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to malicious sites. The presence of 'Password-protected archive handoff' and 'QR-code redirect lure' heuristics further supports a multi-stage attack where the PDF acts as a lure to obtain further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 8

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=the+sharper+image+binoculars+instructions PDF link annotation
    • http://online-bestshop.xyz/kawakozekazosabajupnc7r.pdfIn PDF document text
    • http://ritual-venki.online/funny_easy_riddles_with_answerscjimp.pdfIn PDF document text
    • https://dururamud.weebly.com/uploads/1/3/4/8/134846475/9319994.pdfIn PDF document text
    • http://giveaway2020.info/merchant_of_venice_summary_act_2byvyg.pdfIn PDF document text
    • http://stavki.link/google_translate_languages_codesucavv.pdfIn PDF document text
    • https://jezilifubi.weebly.com/uploads/1/3/4/8/134887413/pivawozanebesamoxan.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_a965b0c6a1234392b7ad9f30f687d452.pdf?index=trueIn PDF document text
    • https://6d428a25-da86-44fa-8f13-5b0f09742281.filesusr.com/ugd/3649d2_2daf9a8a6e0146bd95b610f6e218b086.pdf?index=trueIn PDF document text
    • https://77cbb24c-feae-490b-854c-0a9d4db21a85.filesusr.com/ugd/3752ea_8db56d74eddd42d0be9526955cf149c8.pdf?index=trueIn PDF document text
    • https://0633afab-057d-4448-85e1-ac1a97571725.filesusr.com/ugd/66920c_973149e40fd74fa38160061501d2ceac.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0c8d7e0-4708-4ae5-986d-7074ce2f5d84/how_to_reset_check_engine_light_2013_silverado.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db91ad14-c713-4c20-bd27-255bc384bb28/luwafivudodi.pdfIn PDF document text
    • https://edb7bb8d-792a-4213-93ec-7f573d37cc74.filesusr.com/ugd/bfd504_72ad87b78178408ca5995b7f04ac048d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f647015-2661-41e4-8f9e-05d2e2b2c4f1/26517587339.pdfIn PDF document text
    • https://2703069b-a6ff-4ff9-983c-db139a8d76ba.filesusr.com/ugd/8b61cf_78ef43c2bce148d7b6db7191fdbaae46.pdf?index=trueIn PDF document text
    • https://6f672a44-e16c-4921-a0f1-e3781c0647c5.filesusr.com/ugd/bda22a_bc8f8d08267d49a4b432f7a8e1f725f0.pdf?index=trueIn PDF document text
    • https://bb491b24-4c81-4ccc-8daa-bf1baeb171c2.filesusr.com/ugd/93c935_93044081cee34413862c4dfc66ff0a4f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/96f0f163-4cdc-40ce-8e39-9b09f9ab2ba7/88247785646.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52ea91cd-6e7c-49ff-bc62-9a34ed3db747/what_are_weighted_blankets_for_toddlers.pdfIn PDF document text
    • https://51fd5013-30c4-43d1-89ce-86564632a3b5.filesusr.com/ugd/9f06f8_b370ff14ab86453cbf271ffe1f227d3d.pdf?index=trueIn PDF document text
    • https://b3159766-6c8b-4733-a97d-e59ef6783693.filesusr.com/ugd/21851e_08b7147633b74879b7dcc5a121fc096f.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010429.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10429 5316 bytes
SHA-256: 8a6531d7bc54d4a9050a1a82b55b8bccecaa0acfb2c78518fdce5e6e2a6a203b
font_01_sfnt_off00011611.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11611 12248 bytes
SHA-256: 53ea1c14a2599317105672e2b990dd9e5cf9eefb090a5ee1e8d489c63b07d2c4
font_02_sfnt_off00013f6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F6E 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.