Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdca448bc80c6f79…

MALICIOUS

PDF

96.9 KB Created: 2021-04-01 06:53:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0f0302bb0eabb01a1a2723c4adc39e43 SHA-1: 1575a1e2dc9d0a3961a6798430e95a123611eed0 SHA-256: cdca448bc80c6f79d215f0593c72ac886d43d004495064b5bac2600a5dbd5a7f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains a large number of external links, many of which point to potentially malicious domains, suggesting a link farm or phishing operation. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic strongly indicate that the document is designed to redirect users to malicious websites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=balancing+chemical+equations+examples+pdf
    • https://cdn.sqhk.co/vixemujomu/QPhdEhL/street_racing_lock_screen_iphone.pdf
    • http://wacc-cat.org/78135751585khd6w.pdf
    • http://meblik.su/law_like_love_analysiscka2d.pdf
    • https://benipotuwazel.weebly.com/uploads/1/3/4/4/134445242/8416245.pdf
    • http://persequen.com/jilakevos4ih.pdf
    • http://xikumidevulofo.iblogger.org/breath_of_fire_2_snes_manual.pdf
    • https://dilozekilofak.weebly.com/uploads/1/3/5/9/135968706/fumobibulerexez_tamarapofilirop_satax.pdf
    • https://cdn.sqhk.co/gujurolekuma/j5hhAjb/lineage_2_revolution_dwarf_slayer_guide.pdf
    • http://hangookoil.ru/xokewekaf5zdeg.pdf
    • http://life-news.tech/979429528954znu.pdf
    • https://cdn.sqhk.co/jowapezo/iijfjd6/pusozutinitadolomanapedab.pdf
    • https://cdn.sqhk.co/zirixegip/g2jecyg/lighthouse_point_florida_to_miami.pdf
    • http://idealslimitalia-ufficiale.site/interior_decorating_courses_in_south_africa07z6x.pdf
    • https://cdn.sqhk.co/vawadawuleja/bhdhdGd/viking_saga_2_new_world.pdf
    • http://tradestaroffice.com/razabolusq12.pdf
    • http://lavka-karamel.ru/campaign_strategymi6a4.pdf
    • http://andyhongdigital.com/xajogaa2sp7.pdf
    • https://cdn.sqhk.co/dodamewope/jSge2jc/ates_ve_su_1_oyunu_oyna_oyun_skor.pdf
    • http://wiinorama.fun/why_is_my_subwoofer_not_connecting_to_soundbarf8jr5.pdf
    • https://cdn.sqhk.co/fimegasaz/hwYzeet/78452921734.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://futisilatixukep.rf.gd/carolina_hurricanes_schedule_2020_19.pdf
    • http://gudonuwoponiri.rf.gd/lufubomaf.pdf
    • http://pudofekulud.rf.gd/how_to_program_dish_remote_to_joey_receiver.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001221b.bin
cc133bf18354ef49c0e596dd920ec5f9fe992a886e3c24942754f4ab348b6b4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1221B 5716 bytes
font_01_sfnt_off00013570.bin
807ee3826e4492be9830340b9ffe832f9486c2f986e40e8d44ea6120e4f09c6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13570 12592 bytes
font_02_sfnt_off00016093.bin
e519f4e4ac6d9b0f57dce0c0d49b484e4d1d842646fa75230b4829220ba81c73		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16093 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.