Malicious PDF — malware analysis report

Static analysis result for SHA-256 d89c2cc147ce83f1…

MALICIOUS

PDF

76.9 KB Created: 2021-03-14 23:33:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7217e73dafe1f15bcda858b6d17495f7 SHA-1: ead7438efb51def30b6448bf8dbc77c37f23ea49 SHA-256: d89c2cc147ce83f1cc9cbcb28f91f61ebb81d9c15ab46fdcef209b71f0defcd8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many of which are disguised as search results for educational materials. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to redirect users to malicious sites. The ML classifier and ClamAV detection strongly suggest malicious intent, with the primary attack vector being a phishing attempt via a malicious attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=headway+beginner+student+s+book+pdf+free
    • https://cdn-cms.f-static.net/uploads/4485714/normal_6028779868636.pdf
    • https://static.s123-cdn-static.com/uploads/4451019/normal_5fe31472533c2.pdf
    • http://speak4pro.com/hoard_of_the_dragon_queen_5edn7ze.pdf
    • https://static.s123-cdn-static.com/uploads/4446027/normal_6009ace41fefb.pdf
    • https://cdn.sqhk.co/fupipevu/aZjgghd/buffalo_bills_uniform_rumors.pdf
    • https://cdn.sqhk.co/worekoxe/cxMTxzI/fruit_cube_blast_apk.pdf
    • http://dvigatel.guru/rumemiwakowintoo6e.pdf
    • https://cdn.sqhk.co/mezadisedud/gfgePjb/bevekixufox.pdf
    • https://cdn.sqhk.co/fujalapevame/aIKhfzY/62975131093.pdf
    • https://cdn-cms.f-static.net/uploads/4407804/normal_6036a6eb82152.pdf
    • https://cdn-cms.f-static.net/uploads/4409811/normal_6032283404065.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7c051600-dffe-44c8-9200-f76ca769f62e/flight_behavior_chapter_1_summary.pdf
    • https://f579be4a-c2ec-451d-94ee-532237c06880.filesusr.com/ugd/9f6a24_63cdb5335d0840cc8ea21fa516b36041.pdf?index=true
    • https://144c9d4d-401b-437b-b89f-6a5816d7da47.filesusr.com/ugd/cd33f5_4ce1de03cdc94e6c856029409c9e1149.pdf?index=true
    • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_e44e4f7e83e24532b0b919a05ad6670f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8539e385-4f9e-4c88-87db-b36b1b7db8a7/peposenajusud.pdf
    • https://uploads.strikinglycdn.com/files/1964c9a5-1996-438f-9dd5-1d883c899a15/manual_de_gps_garmin_12_xl_en_espaol.pdf
    • https://uploads.strikinglycdn.com/files/ddac29e7-560e-4f2e-bbb7-50a795c76105/how_to_calculate_heat_flow.pdf
    • https://ea7788ad-ef5a-48b5-911d-3ad522045378.filesusr.com/ugd/f3bfbb_bf5a3c3735f04908811294eefe1a706c.pdf?index=true
    • https://c948e902-2437-43f3-9f1e-7aaad30688a7.filesusr.com/ugd/464a75_dc42dac62016493ca5748513279f4ff6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0f75f449-230a-42ad-b819-a130ae7a6bbb/como_orar_en_el_espiritu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eda8.bin
f7a842bf9d4e9c6ee2afae9bae408d0dff44e810a915428d5bf5385351e43247		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDA8 5536 bytes
font_01_sfnt_off000100a4.bin
441b7addc7f709067b6332804493f11c7ee3acf9bdc1f6293b97ec965ecadc62		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100A4 11060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.