Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7a8ddce6c9dc2e7…

MALICIOUS

PDF

77.1 KB Created: 2021-04-04 00:03:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 90c36d7be57ff5e76b65359ae4c9f706 SHA-1: 56cc06d220175a338c9de4adaaf78556a802e464 SHA-256: d7a8ddce6c9dc2e7704bc85e5c4a296647443559c2aa6720db7a195c9b7b9f68
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that mimics a search result, likely intended to trick users into visiting a malicious site. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically phishing. While no scripts were directly extracted, the PDF structure and embedded URI suggest a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=svm+algorithm+in+machine+learning+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4454544/normal_605b67dd8828f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454041/normal_5ff1f2358bf2c.pdfIn PDF document text
    • http://znohist.site/90991130028gfogo.pdfIn PDF document text
    • http://zaliv2k20wowowowoow.xyz/pride_lift_chair_serial_number_lookugsi8v.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393348/normal_6027024c0c2c5.pdfIn PDF document text
    • http://mx50off.info/how_many_calories_in_a_dunkin_egg_and_cheese_wake_up_wrapqobgr.pdfIn PDF document text
    • http://devlp.design/introduction_to_ergonomics_bookxvqhj.pdfIn PDF document text
    • http://erogan-encolumbia.site/castrol_20w50_mineralischl1m6s.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://438c9214-13ba-44a2-8469-a4c97ff43377.filesusr.com/ugd/5d46a0_488a6d6767f246d19015d83c76e8a51c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rirusozo/spatial_statistics_in_gis.pdfIn PDF document text
    • https://69f7c7ec-f776-4f8b-90c4-e8126cd531e3.filesusr.com/ugd/772020_e5b83341aa3a4664bdc02433715a2c90.pdf?index=trueIn PDF document text
    • https://8d928d4c-4e32-4dc6-8093-d383c90b3cca.filesusr.com/ugd/b5d49c_5dc26295e86c462aa27273d430a193dc.pdf?index=trueIn PDF document text
    • https://1350f94c-8d6f-42b4-8351-24983ad6a49a.filesusr.com/ugd/4aae87_812941eb6d9f49798199dd84fdedfe7b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/englander_pellet_stove_best_settings.pdfIn PDF document text
    • https://s3.amazonaws.com/jujojomojemiz/permutation_without_repetition_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/saziwijaxodav/xukimupekarex.pdfIn PDF document text
    • https://s3.amazonaws.com/toguvaju/galvanized_corrugated_sheet_supplier_in_uae.pdfIn PDF document text
    • https://535a9070-e28a-464b-adc5-c02ad08be00b.filesusr.com/ugd/9df9d6_c9a63c1fd1ea4efbaf5875020b427aba.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zikeko/frases_del_libro_amor_en_tiempos_de_colera.pdfIn PDF document text
    • https://2c549fd3-bbcc-4e43-aea5-84609313cfd4.filesusr.com/ugd/c162b3_ddc939d5497a4c3280ae574f8f66548b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zisulamisozoto/budweiser_beer_steins_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/divexikav/kalepakubusepejofebexufa.pdfIn PDF document text
    • https://s3.amazonaws.com/tufitijinexu/datokufekasal.pdfIn PDF document text
    • https://063758de-fb2f-4258-809e-b727485bfd5a.filesusr.com/ugd/89cda4_1e01953c74ae49f89e4dd3f15d3fa396.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF04 5552 bytes
SHA-256: dc0745ca84141ea2e8374c584d91687ec1407fbe757d5c02d347d0de1d0a8c98
font_01_sfnt_off000101c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101C2 10836 bytes
SHA-256: b4b35b97f44c6c7bb4992130263a341a54b7b5da3e0072dea247bd8ee0443a55

Open this report in the interactive analyzer, or submit your own file for analysis.