Malicious PDF — malware analysis report

Static analysis result for SHA-256 d74e096dc94fabe1…

MALICIOUS

PDF

86.8 KB Created: 2021-03-22 20:23:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd327b90b1f9c42761169306ec2fdd8c SHA-1: d5057e2d66b6ad0bfeba4b1b8f79f9af009d8846 SHA-256: d74e096dc94fabe10fc63a1a28ed1e14aaff1d94f6a7fe26a8319c1020a7e09e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, identified as a link farm, designed to redirect users to other PDF files. The heuristic 'PDF_SEO_LINK_FARM' and the presence of numerous URLs strongly suggest a phishing or malware distribution attempt. While no scripts were directly extracted, the nature of the link farm and the ClamAV detection indicate a malicious intent to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=biographical+sketch+example+for+students+pdf
    • https://gujojiri.weebly.com/uploads/1/3/4/4/134434224/4569985.pdf
    • https://static.s123-cdn-static.com/uploads/4403808/normal_5fcd573948915.pdf
    • https://puzejiwitamino.weebly.com/uploads/1/3/1/4/131453698/1365954.pdf
    • https://cdn.sqhk.co/kagelemovo/jgCgdic/attack_of_the_drones_objectives_level_4.pdf
    • http://kepuxom.mypressonline.com/brasses_to_the_fore_march.pdf
    • https://static.s123-cdn-static.com/uploads/4409609/normal_60030ba8e892b.pdf
    • https://kijiranibenadef.weebly.com/uploads/1/3/1/6/131636827/ab2d5126e670029.pdf
    • https://cdn.sqhk.co/wukatigubo/gd1qhjR/real_craft_mod_for_mcpe.pdf
    • https://cdn-cms.f-static.net/uploads/4463809/normal_5fe770b565e7b.pdf
    • https://static.s123-cdn-static.com/uploads/4403565/normal_5ff77a7bec4e5.pdf
    • http://sesesuruko.mypressonline.com/business_loan_application_letter_sample.pdf
    • https://cdn.sqhk.co/rijunawep/hckX4gd/fly_hawaii_hack_mod_apk.pdf
    • http://pimifawimonidij.mywebcommunity.org/acidose_tubulaire_proximale.pdf
    • https://cdn.sqhk.co/serodozire/iijiIyI/cardboard_cat_house_aldi.pdf
    • https://kujugozu.weebly.com/uploads/1/3/4/6/134660126/4258806.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e20ca3d3-1d4d-4f89-af16-ce80d1cf4665/somulaw.pdf
    • https://uploads.strikinglycdn.com/files/1fcb5ff0-0a36-4c40-b4fe-f9302af0e879/solixed.pdf
    • http://zisukuvi.atwebpages.com/91740009459.pdf
    • http://rigidafavubo.myartsonline.com/fumenikelirunutevutavuv.pdf
    • https://uploads.strikinglycdn.com/files/ae986150-7de3-4c0d-8dcd-dcd2be6fa0ad/boatswains_mate_school_navy.pdf
    • https://uploads.strikinglycdn.com/files/1cfe618f-9163-4415-be91-a111d7efa3d4/pupafebal.pdf
    • https://uploads.strikinglycdn.com/files/b46118f2-6c74-473a-adc8-1d8c52a417fa/how_to_use_schrader_presta_clever_valve_pump.pdf
    • https://uploads.strikinglycdn.com/files/147ea560-2927-4b1d-85f4-033b0768773f/god_is_a_matchmaker_quotes.pdf
    • http://www.readwritethink.org/classroom-resources/lesson-plans/writers-workshop-biographical-sketc
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011618.bin
597f26c445fab6a8c4c69cb43fc89a7b0093ed90b47cd53dc016e248bb7ea945		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11618 5748 bytes
font_01_sfnt_off0001298e.bin
d1ea27326e9a1b39f5e8635032d95fbdd590349f89f1e819d712e685a859067d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1298E 10580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.