Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddaa462456c982bc…

MALICIOUS

PDF

109.4 KB Created: 2021-02-22 14:30:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: f74c3f29505f69e5af44e9e8a4451096 SHA-1: aacce3dfe67661f2c476590588292e761dde7ae8 SHA-256: ddaa462456c982bce1e9884e2651bf0a6e85792f2b7e6fd55a0c57f52d8aa4da
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and numerous external links suggest it's designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=python+web+development+with+django+projects PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4498404/normal_6003908344880.pdfIn PDF document text
    • http://reduslimitaly-official.site/pazapujubenj5qpo.pdfIn PDF document text
    • https://gisimezibeze.weebly.com/uploads/1/3/0/8/130874543/4a240f74f5a1fc0.pdfIn PDF document text
    • http://socialwave.me/zubukojolilebuwedawebirqozcz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417033/normal_5ff76f3cdbb1a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445107/normal_6007558667b48.pdfIn PDF document text
    • https://fadefewili.weebly.com/uploads/1/3/4/3/134316521/3134139.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385613/normal_5fef462b0c9b8.pdfIn PDF document text
    • http://oneitstore.info/zerepufibakaj9g4z.pdfIn PDF document text
    • http://silver35.ru/mofavadetogemoteritefefwgppu.pdfIn PDF document text
    • http://gnoogle.site/195757449566t0t0.pdfIn PDF document text
    • http://vipadminler.org/nezizorurery569a.pdfIn PDF document text
    • https://jipoditilab.weebly.com/uploads/1/3/1/4/131407274/5140632.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4422906/normal_6005eac8aebc9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470985/normal_5fcb56483b1da.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tidigudetefumof/7642250281.pdfIn PDF document text
    • https://s3.amazonaws.com/levovod/biology_corner_worksheets_analyzing_data.pdfIn PDF document text
    • https://s3.amazonaws.com/voxulija/bajirao_mastani_tamil_full_movie.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000143e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143E5 6440 bytes
SHA-256: 3d4760ca295192c89086870ebbac49c5a5945404ea6ab57fca452cf2db5f569a
font_01_sfnt_off000153d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x153D9 5956 bytes
SHA-256: e5f226de3ac33beae24f72b120c3aff4d8a188a4c7ef2b6686b10fd3cad751cf
font_02_sfnt_off00016811.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16811 12776 bytes
SHA-256: 2bb2bccd1cdc5460c9a63f5706165ee0687ca902f86c0512aa89102a1f6cf022
font_03_sfnt_off000191d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x191D1 16336 bytes
SHA-256: b7ec44cfe2208ace95a2ce43e698390e22c67aa42018be4a86f0f90cbe714ace

Open this report in the interactive analyzer, or submit your own file for analysis.