Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2cacfa416090042…

MALICIOUS

PDF

77.3 KB Created: 2021-03-26 09:14:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1b265451f7e6ff59c3ad497d2feb4801 SHA-1: e2576d386564f5d0657d0517445b7a2dd1ca690c SHA-256: e2cacfa41609004268bc263c7cd8e6c2da4473721c5735e1cea1ac24e60308ec
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including PDF_SEO_LINK_FARM and ML_NYX_PDF_MALICIOUS, indicating a high likelihood of malicious intent. It contains numerous external links, many of which point to suspicious domains, suggesting it's part of a link farm designed to redirect users to potentially harmful content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=head+basketball+unblocked+championship
    • https://cdn-cms.f-static.net/uploads/4453891/normal_6039f68c2d22f.pdf
    • https://static.s123-cdn-static.com/uploads/4469116/normal_5fef566c6d565.pdf
    • https://cdn-cms.f-static.net/uploads/4413987/normal_5fda730ed19ea.pdf
    • http://sqrab.top/stack_cubes_gamea3unf.pdf
    • https://cdn-cms.f-static.net/uploads/4387939/normal_6029370d4a5f0.pdf
    • https://static.s123-cdn-static.com/uploads/4464068/normal_5fe0ba11b14be.pdf
    • https://cdn-cms.f-static.net/uploads/4413118/normal_6017458b75070.pdf
    • http://nosinoski.shop/sofewumezagadelipijugs08g.pdf
    • http://repaircreditscore.info/can_covid_19_cause_high_blood_pressure_to_spikeliypn.pdf
    • https://cdn-cms.f-static.net/uploads/4458827/normal_6049a9f76f760.pdf
    • http://marketitaly.pro/bullet_force_mod_androidxqwda.pdf
    • https://zudibuliri.weebly.com/uploads/1/3/5/3/135319562/f2cd2.pdf
    • https://widetidutu.weebly.com/uploads/1/3/1/4/131453832/a37329111.pdf
    • https://cdn-cms.f-static.net/uploads/4446390/normal_6021c1c1c91d1.pdf
    • https://xoxigukot.weebly.com/uploads/1/3/4/8/134861038/5398120.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0a880b82-d8e8-419b-a540-9333c79833b1/reset_fitbit_charge_hr_time_and_date.pdf
    • https://s3.amazonaws.com/fikuvine/51950744936.pdf
    • https://s3.amazonaws.com/poguvelefa/lolibusipel.pdf
    • https://uploads.strikinglycdn.com/files/a259c506-1f23-4b5a-b4b4-4ebde89fda0a/tissot_t_touch_review_expert.pdf
    • https://uploads.strikinglycdn.com/files/64f2ae76-bdee-4c45-8f72-68d67ae40db0/50170773749.pdf
    • https://uploads.strikinglycdn.com/files/d49e653e-32fc-4c77-a288-c1a29b18b91b/36793162342.pdf
    • https://s3.amazonaws.com/meludav/sogufarubo.pdf
    • https://uploads.strikinglycdn.com/files/4707be84-8b5f-4322-b049-a16d59586f9b/troy_bilt_mower_spark_plug.pdf
    • https://s3.amazonaws.com/lezerawe/netof.pdf
    • https://s3.amazonaws.com/nowokil/manualidades_con_botellas_desechables_paso_a_paso.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f19e.bin
f10139f4af88b6aaf5e8b0524bb4dedbc31776414f839c7c1f3db10d1b2fdbe4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF19E 5384 bytes
font_01_sfnt_off000103be.bin
7bfbfd5a68d1b9cc59208f4affaddbaca46e8c0c5dd3a22f0a3c407aa367f738		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103BE 10476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.