Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0b7b75b42ac5040…

MALICIOUS

PDF

80.2 KB Created: 2021-03-24 13:35:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b911f9fe072cc60ae345fb6292df6ee8 SHA-1: 56b145432be0c9609df5cef1852f342ee325fb93 SHA-256: d0b7b75b42ac5040fb8ef413cae0dc663636458bfa1e05fc64f3a50b9092b14a
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to unknown domains, suggesting a link farm or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a malicious document designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=animal+sounds+in+english+pdf
    • https://xavujome.weebly.com/uploads/1/3/0/7/130739328/mimowoxu.pdf
    • https://xunujigunabiwuf.weebly.com/uploads/1/3/4/0/134017077/tatuzanedajezi.pdf
    • https://jepigosewuva.weebly.com/uploads/1/3/2/3/132302921/nirido_notij_kekoxazomus.pdf
    • http://glasshookahcatering.com/navy_seal_training_camp_namev1hfs.pdf
    • http://mebelrostov.ru/penulewijikiropad2wxl.pdf
    • https://xoxovumalojiru.weebly.com/uploads/1/3/0/8/130874224/b872c4c.pdf
    • https://zinorenote.weebly.com/uploads/1/3/5/3/135349773/lanurupiv.pdf
    • http://iranianvc.com/14091851469vi49e.pdf
    • http://card2card-perevod24.site/descargar_tubemate_gratis_para_androe187l.pdf
    • https://limopepubev.weebly.com/uploads/1/3/4/6/134627214/f74e15.pdf
    • https://xaroduzorosu.weebly.com/uploads/1/3/1/3/131398324/617b203ab3.pdf
    • http://jadebey-x.com/55029321395j007v.pdf
    • https://jasebezaf.weebly.com/uploads/1/3/4/6/134630561/wijawudi.pdf
    • https://witojezig.weebly.com/uploads/1/3/0/7/130776148/062e73ceef5bb2.pdf
    • https://sozogamawi.weebly.com/uploads/1/3/1/6/131636736/813c1a990755.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ada29541-e695-457c-9815-dec87316dd10/zoguzaxuki.pdf
    • https://uploads.strikinglycdn.com/files/d66dbed5-23bc-4c9f-a7cf-e968ff094348/buzz_lightyear_lego_instruction_manual.pdf
    • https://uploads.strikinglycdn.com/files/01a4512d-e0b1-4ea1-987d-d40920259db1/star_trek_into_darkness_watch_online.pdf
    • https://uploads.strikinglycdn.com/files/4628005f-7e48-4540-902d-03ab19d25e78/holmes_humidifier_fan_not_working.pdf
    • https://uploads.strikinglycdn.com/files/eb6cf994-7efe-430f-b9b5-7c67a2737f9c/44727645183.pdf
    • https://uploads.strikinglycdn.com/files/deb6f5bb-4d97-4ee9-95bb-8c3f10dee78a/do_churches_do_marriage_counseling.pdf
    • http://kirezalodonuni.epizy.com/lepelusufefaziso.pdf
    • https://uploads.strikinglycdn.com/files/1cf23854-51b7-47ea-9f13-9520964559e7/86758804692.pdf
    • http://gugaginewus.rf.gd/31097188132.pdf
    • https://uploads.strikinglycdn.com/files/cd4375fc-c12d-471e-99f0-ddaa1c5c2ed5/belaboresetovol.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa97.bin
5a28058d90dc46e6ff9cc038bdfdaa13bd47b4931e56959bb9e9487de2d0bc0e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA97 5348 bytes
font_01_sfnt_off00010c9d.bin
118cc57fb04f7d8bc59e6f333630d8de10fcb536343c3039690ab098b3841348		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C9D 11692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.