Malicious PDF — malware analysis report

Static analysis result for SHA-256 dfb55643a9a1a0ef…

MALICIOUS

PDF

77.6 KB Created: 2021-05-03 22:22:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12ccd9783fdb2eb0b7dbd0541fcc1725 SHA-1: 58dc9838b3037cf953b265b51e02b55d9449097d SHA-256: dfb55643a9a1a0ef937b05d9ba3ef83b61e3a79d805a982f6fbcac73506cdda3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. The presence of a large number of external links, identified as a PDF link farm, suggests a malicious intent to manipulate search engine results or redirect users to potentially harmful content. The file's metadata indicates it was generated by wkhtmltopdf, a tool often used to create PDFs from web content, which could be leveraged for phishing or spam campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+to+use+architectural+triangular+scale
    • https://cdn-cms.f-static.net/uploads/4403413/normal_601feddd599da.pdf
    • https://static.s123-cdn-static.com/uploads/4427519/normal_5fcb17edd8576.pdf
    • https://static.s123-cdn-static.com/uploads/4374682/normal_6000f1a26b4f8.pdf
    • https://metenesepagozo.weebly.com/uploads/1/3/4/7/134710396/606861.pdf
    • https://static.s123-cdn-static.com/uploads/4487647/normal_5fc6b8f6e3afe.pdf
    • https://pefibiwurabamiz.weebly.com/uploads/1/3/0/8/130874510/tisamogemavi_mumejebadozu_solaxerod.pdf
    • https://tedumuwoke.weebly.com/uploads/1/3/1/3/131397970/xazidamika_simukegezomapuk_visom_mutarebetigo.pdf
    • https://static.s123-cdn-static.com/uploads/4473053/normal_5fffa0c8e9020.pdf
    • https://povurumupun.weebly.com/uploads/1/3/4/8/134884194/9891487.pdf
    • https://penogefuf.weebly.com/uploads/1/3/2/7/132740618/todozudodozoj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sisaxu/toyota_rav4_fuel_economy_l_100km.pdf
    • https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_7a4386c529c5496a9e4982a54fe711ae.pdf?index=true
    • https://s3.amazonaws.com/kijelopazekune/xawejizamo.pdf
    • https://1a9cd40a-f0d6-44d4-a143-19288280ca2b.filesusr.com/ugd/7a13df_c7cb8fabd87147e6a76c871adf0a3e79.pdf?index=true
    • https://uploads.strikinglycdn.com/files/439e74ab-8fe0-470b-ba85-6c764d626361/interior_design_styles_book.pdf
    • https://s3.amazonaws.com/mefovu/13865147670.pdf
    • https://uploads.strikinglycdn.com/files/b689091e-c3b5-4b46-bfe3-08b8f80de02a/how_to_install_dymo_labelwriter_4xl_on_mac.pdf
    • https://327bbe42-9aa5-4ca0-80e5-6c9857058a26.filesusr.com/ugd/2b870b_b6989883e26d43fd9218cc28683bc45c.pdf?index=true
    • https://s3.amazonaws.com/kewuxejikiwe/bapadifogifixevidimiw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eff4.bin
6145439efa39183f4c9a607540d98797b687d9ac7ca2591519a9c7a8d9021e32		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFF4 5116 bytes
font_01_sfnt_off00010165.bin
82f810624b3c5e9d56cef89fd93a152903e4a6cc1de71547b75fe7fefee85e18		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10165 12228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.