Malicious PDF — malware analysis report

Static analysis result for SHA-256 e08ebc003b0b4310…

MALICIOUS

PDF

73.5 KB Created: 2021-05-16 02:48:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: eb089238be2c29aad0a3f4612a25f269 SHA-1: 6580909c8dbc64b91a5a8bc24f8eeda91a8baeee SHA-256: e08ebc003b0b4310aa0e153f6201d17d36cde8445ba7de79bccbbcb6556fc7fe
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious and likely phishing-related. It contains a large number of external links, many of which point to PDF files, suggesting a link farm or redirection scheme. The document body is heavily obfuscated and contains metadata indicating it was generated by wkhtmltopdf, a tool often used to create PDF versions of web pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=eclipse+fit+clip+mp3+player+shuffle PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4421957/normal_5ffe98a4577fe.pdfIn PDF document text
    • https://xonalofogikovor.weebly.com/uploads/1/3/4/3/134372302/jeguvus.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476577/normal_606e20ac46967.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413567/normal_5fd39ec6eed37.pdfIn PDF document text
    • http://nnorm-id.com/commonly_used_phrasal_verbs_list_with_examples3u4fn.pdfIn PDF document text
    • http://net-klientov.ru/52686983757gcxhk.pdfIn PDF document text
    • https://xapetivaxi.weebly.com/uploads/1/3/5/3/135347241/1324451.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372985/normal_5fda3a216ef14.pdfIn PDF document text
    • https://didukomam.weebly.com/uploads/1/3/1/8/131857465/5710429.pdfIn PDF document text
    • http://littlenat.space/24449828336zchnq.pdfIn PDF document text
    • http://copyrightshelpcenter.com/how_to_call_forward_att_landlinefn5g8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421365/normal_601dfb2e6b016.pdfIn PDF document text
    • https://sezitoxonuga.weebly.com/uploads/1/3/4/8/134886233/4033696.pdfIn PDF document text
    • http://ryursew.space/planned_parenthood_abortions_performed_2016vppja.pdfIn PDF document text
    • http://fitness-ital.fun/whatsapp_status_photos_telugunjhhc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wekibik/25389750785.pdfIn PDF document text
    • https://s3.amazonaws.com/wozowuledij/new_era_fitted_cap_size_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xupizewuxere/munson_fluid_mechanics_solution_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/luxelula/how_to_learn_r_programming_fast.pdfIn PDF document text
    • https://s3.amazonaws.com/bufipevuril/wikobekomegejevipakux.pdfIn PDF document text
    • https://s3.amazonaws.com/vatosolikijike/duredototopunubekafem.pdfIn PDF document text
    • https://s3.amazonaws.com/zevutebulaworel/the_reluctant_fundamentalist_book_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e248.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE248 5476 bytes
SHA-256: 2dc223b9a6abe34fac1d3e88bb756d294fec6e33fd7ff2ee48c3c0c53540cc4c
font_01_sfnt_off0000f4c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4C8 10424 bytes
SHA-256: 1e434e03233df77b5494784f9abd3e6795ddc79dbbbc540da56ba8a26e285d80

Open this report in the interactive analyzer, or submit your own file for analysis.