Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3c49ad9cd8eafda…

MALICIOUS

PDF

83.1 KB Created: 2021-04-05 16:47:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 237116529f906048a3771a00e9ca4a0b SHA-1: d28ae716389657a454777fa2af626b79d53f9e07 SHA-256: d3c49ad9cd8eafdae0be48aa71be9da5d1578d32937509513338222e91192665
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. It contains a large number of external links, a common tactic for phishing or SEO spam. While no scripts were directly extracted, the presence of embedded URLs and the PDF structure suggest an attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=pico+tts+apkpure
    • https://static.s123-cdn-static.com/uploads/4392218/normal_5fcd7582ca468.pdf
    • http://geloritiveda.mygamesonline.org/97104330545.pdf
    • http://sumigemag.mywebcommunity.org/bifilar_pendulum_experiment.pdf
    • http://bigezidara.mypressonline.com/kejibetabinol.pdf
    • http://topukovatawosu.sportsontheweb.net/kusegumozedezotume.pdf
    • http://sebekeruxa.iblogger.org/figoz.pdf
    • https://static.s123-cdn-static.com/uploads/4374848/normal_5ffcd96fca1a0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/72a58ddb-0399-4ce2-8197-48367622a01e/46118478365.pdf
    • https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_9b1e1c90e95b49ffbeb0d1024579d998.pdf?index=true
    • https://64f1e6a9-4530-4009-9f9b-67b91dd69f79.filesusr.com/ugd/76b6de_fe14e49a7dc442f6addbc83b93ffda22.pdf?index=true
    • https://uploads.strikinglycdn.com/files/13cff752-4305-4020-b96e-98a89fd4f3f2/your_first_year_in_network_marketing_audiobook.pdf
    • https://21a67f6d-2aea-439f-a910-ed4feb6be009.filesusr.com/ugd/173616_f6cb7c76a4fd4061942b70b658c6e1e5.pdf?index=true
    • https://a9f3490c-def6-45ea-9957-aefa341d54bd.filesusr.com/ugd/84b587_b64e3168e7e34c7ea4c905956befde2e.pdf?index=true
    • https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_72dd892466d243a9a791164ca5865681.pdf?index=true
    • http://fabavokawibawo.epizy.com/chemistry_formula_for_iit_jee.pdf
    • https://6d5fec37-5936-4ae8-8938-03a86e982f09.filesusr.com/ugd/d4da64_3b72db88ee8f4a03a952f84a193de833.pdf?index=true
    • https://48e6b720-b653-4920-beb0-7ef171ab6ab9.filesusr.com/ugd/d9d1f5_7940f240e9f94279bfb5d09bad957f7d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7b0252fa-fa58-4f12-8f16-e97dd3ad56b7/voxewexadusituf.pdf
    • http://dasopikabuma.rf.gd/campbell_biology_10th_edition_ebook_download.pdf
    • http://nojutunaraxo.rf.gd/capillary_electrophoresis_applications.pdf
    • https://uploads.strikinglycdn.com/files/521c9279-a731-4c3c-8766-e1c4c856e902/how_to_take_off_glacier_bay_shower_handle.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e25c.bin
e0924c286ebd2f03115b777ff3cdaf8b21ef147258d7ff583def99c1e8b8c005		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE25C 3820 bytes
font_01_sfnt_off0000eff6.bin
49b6021b6dc18358e23e1950854d103e0ce34a24d27a3649c1eeff7082efc952		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFF6 4960 bytes
font_02_sfnt_off000100ef.bin
8e8fac8048ddf586ecb09420bd60acc46c592e52cfcb71cdd835d5d9cb8a1087		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100EF 11028 bytes
font_03_sfnt_off000126cb.bin
cfcd05a0c4c29650fb289d3b9d3ed26e082e8f5a1b5b712b0509a6c70894056a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126CB 16468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.