Malicious PDF — malware analysis report

Static analysis result for SHA-256 d18c9443e4c14b6b…

MALICIOUS

PDF

80.2 KB Created: 2021-05-15 01:36:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e091da5d94d4bfcab4991fcb255a2a4f SHA-1: d6d10283ed87b95b2d4d764fe2f65bf9835bc9fb SHA-256: d18c9443e4c14b6b208a9a6e02f606c8c50ad458a0b52f6d9a608cae3d4ff150
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as a malicious PDF by multiple heuristics and an ML classifier. It contains a large number of external links, indicating a link farm or redirection strategy. The presence of embedded URLs and the ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggest a phishing or malware distribution intent. While no scripts were explicitly extracted, the PDF structure and link farm behavior are indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=r+gupta+books+fci+pdf
    • https://gozerivolese.weebly.com/uploads/1/3/4/2/134265833/memomebusej-lumurafibefid.pdf
    • https://donabetolemi.weebly.com/uploads/1/3/1/6/131637402/zugelaruxinexid.pdf
    • http://phtech.site/kolezuhq2n0.pdf
    • https://rixagaxovexi.weebly.com/uploads/1/3/4/0/134000332/gaxutig-xibileposu-robadigif-purepodarovutar.pdf
    • http://hisgohar.site/8986103639576t1d.pdf
    • https://bejuzozomixur.weebly.com/uploads/1/3/5/9/135966319/33bfe7f0d2da.pdf
    • http://sitajejo.22web.org/79227969455.pdf
    • http://datingsexchat.site/92274578780s4dzg.pdf
    • https://pufujodixig.weebly.com/uploads/1/3/1/4/131438007/melipesodaxutoj.pdf
    • http://sudilufib.getenjoyment.net/parenomoza.pdf
    • http://sadovik.me/77175719276flomy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3dd85f33-233b-4b3c-8e53-142bc8307eec.filesusr.com/ugd/8df890_a552ebce0680484c979ecc2b0bc6345f.pdf?index=true
    • https://9fc80a0e-b25b-4135-afeb-9811a1ea6bf8.filesusr.com/ugd/91e123_e0ddf02f06d24cdab310a592c332d04c.pdf?index=true
    • https://d525ee04-2a40-494f-8ba9-fee52f7b18ee.filesusr.com/ugd/8b8e24_99a21d5271254878a6291ad83cb885dc.pdf?index=true
    • https://ac25a69f-a984-4293-9c3d-8c9e0f062535.filesusr.com/ugd/cbf077_5bd30bfbae6046969b623e38390bc895.pdf?index=true
    • https://e0271a52-a7af-48e9-8a99-924ce320ec62.filesusr.com/ugd/be5703_652eb526c8d1409ea8fc1a0236c844bf.pdf?index=true
    • http://wafubarig.epizy.com/fapurujagopu.pdf
    • http://lukigek.rf.gd/99314549064.pdf
    • http://pawepeg.atwebpages.com/zafagemid.pdf
    • http://rowesotinik.rf.gd/32545563653.pdf
    • http://nolawasewunut.epizy.com/oxford_basic_english_grammar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eeea.bin
5510861e0701cb7f7f57c1c4f6c9cfe19f8a483cefdede93edc0bf9cc0aea221		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEEA 3080 bytes
font_01_sfnt_off0000f9f2.bin
4fecbdd490c59386fed41d6ff7117128c7f2d643a8ce721e0a0f2895d914f47a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9F2 5404 bytes
font_02_sfnt_off00010c72.bin
154ea4b252fc3970024f9544af083ab5771984522268e90b16fec91e38a799dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C72 11488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.