Malicious PDF — malware analysis report

Static analysis result for SHA-256 e78cd8d282ecac0d…

MALICIOUS

PDF

79.8 KB Created: 2021-03-07 15:07:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: dd1cb88b8c8354b2f51bb156e67870cc SHA-1: 2b60c25da7cc25d3de499949e11be28986935175 SHA-256: e78cd8d282ecac0d9cd5aba83eebee1ec50afd1692e75b109f189f02aaaccfa4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to SEO-farm-like domains, suggesting a phishing or spamming campaign. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=how+to+factory+reset+a+hp+pavilion+dv6 PDF link annotation
    • http://salleapp.xyz/aoa_full_form_in_chatb83dn.pdfIn PDF document text
    • http://fsfsfd.xyz/sony_dream_machine_icf-c318_set_timeul32q.pdfIn PDF document text
    • http://copyright-central-media.com/pdf_reader_pro_android_apkxf8m2.pdfIn PDF document text
    • http://submonster.xyz/50_pips_a_day_forex_trading_strategyh96yv.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/bejeseja/best_live_anime_wallpaper_for_android.pdfIn PDF document text
    • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_e3302d7940d74c6a9c6dbcc67aee0819.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebb695d9-8b60-4b03-bb47-c583349e46df/4998531574.pdfIn PDF document text
    • https://s3.amazonaws.com/pewebopufupe/55732889484.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/52288732685.pdfIn PDF document text
    • http://vuxonisozezuxov.rf.gd/komogegiv.pdfIn PDF document text
    • https://b20aee1f-b1b7-4e4e-be5e-d884e4ece670.filesusr.com/ugd/10e3af_d56c8d4c8d8f4d7ebe039ae5d838a6a4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wujapu/33534602640.pdfIn PDF document text
    • https://s3.amazonaws.com/fizup/informix_4gl_interview_questions_answers.pdfIn PDF document text
    • https://e26dc784-fa46-4601-9f6d-57686faaf216.filesusr.com/ugd/c66525_f7b856ed9d5246cc9c320530c5a5438f.pdf?index=trueIn PDF document text
    • http://lesexugisitu.rf.gd/final_fantasy_tactics_advance_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xovajukoxin/76222570578.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b51f660b-4804-422e-8185-c7517d004505/learn_to_read_hieroglyphics.pdfIn PDF document text
    • https://s3.amazonaws.com/savifin/wuxizamekiwaje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e65464f2-f040-459d-99e6-5366353601cd/element_40_inch_1080p_fhd_led_roku_tv.pdfIn PDF document text
    • https://b615eccc-4413-4b1d-8109-ede925130a83.filesusr.com/ugd/0994f9_abe637d1c6334c8b8e9b4c2871056fc3.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eda4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDA4 5400 bytes
SHA-256: a356b21faffabd9be49470b17676674d16223db761f311b8687e74061a739d40
font_01_sfnt_off00010014.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10014 10444 bytes
SHA-256: 5802a3213d1c3c505278c75c79a08dc120f9003e1076856ee256665dfdffa1ae
font_02_sfnt_off000123b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123B8 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.