Malicious PDF — malware analysis report

Static analysis result for SHA-256 df4df829414352ae…

MALICIOUS

PDF

71.9 KB Created: 2021-03-06 08:16:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dc0d93853457005398eca24558256a16 SHA-1: 9c57e25d1f0c16020a6af9c32eff7ccb3671e573 SHA-256: df4df829414352ae0dd330e956d9b40d88d637c6d0206842b1a216b30ec84677
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, suggesting a link farm designed to redirect users to potentially harmful websites. The document body, though partially corrupted, contains text related to free printable PDFs, likely serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=sapo+y+sepo+un+a%25C3%25B1o+entero+pdf+para+imprimir+gratis
    • https://koxizekeb.weebly.com/uploads/1/3/4/7/134770308/9610072.pdf
    • http://vivubowi.getenjoyment.net/38874048225.pdf
    • https://tureduritisamo.weebly.com/uploads/1/3/4/6/134676104/688679.pdf
    • https://fanamavikere.weebly.com/uploads/1/3/4/6/134610997/pidapujutel_vasefuxux_koxuxapalo.pdf
    • http://ronifibofizet.medianewsonline.com/zidonos.pdf
    • http://lipuwisapi.mywebcommunity.org/large_pumpkin_iced_coffee_dunkin_donuts_calories.pdf
    • http://joteruzawareba.iblogger.org/graduation_cap_outline_template.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zurogukewujot.epizy.com/wegexozugibepezin.pdf
    • https://s3.amazonaws.com/zafirawit/79638269505.pdf
    • https://s3.amazonaws.com/gogonof/galiviwaji.pdf
    • https://s3.amazonaws.com/wogikokuzotaxa/audio_recorder_and_editor_android.pdf
    • http://fadojogepu.epizy.com/88124724711.pdf
    • https://4ef57e19-9a2e-4e6f-a444-f6b59f982a39.filesusr.com/ugd/4c1554_4278a6e946ed477e946a5d6cdac8182b.pdf?index=true
    • http://tasowotata.epizy.com/86461049873.pdf
    • https://s3.amazonaws.com/fokapikow/dark_force_rising_books_cool.pdf
    • https://s3.amazonaws.com/faluzotixupi/answer_thank_you_for_the_present.pdf
    • https://89e5ed4a-33eb-42a6-b5f1-9fc07ea1e15b.filesusr.com/ugd/ff68bb_7e55403b7b6c40f386fe56670e67db70.pdf?index=true
    • https://s3.amazonaws.com/vanatul/49755128296.pdf
    • https://29c5b005-6627-40e3-9da1-9f9d3dbc34dc.filesusr.com/ugd/7ad284_b98be01687ce4ba482ae11d290ae442c.pdf?index=true
    • https://s3.amazonaws.com/fewifuwu/63671059263.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d5b4.bin
8758531021fdf0fff4f59a13d05b6bdc73f9f5d34aeee19dbdc7a484fe19abc8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD5B4 5748 bytes
font_01_sfnt_off0000e8f2.bin
9c00f414bdf570e134c62307eab8d09dffb7b5ce77ab9913da78460ce186aad2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8F2 12220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.