Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea254a29bf2918c3…

MALICIOUS

PDF

115.6 KB Created: 2021-04-07 18:46:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4db5c0eff31768549a5479b021a2894 SHA-1: be36e6b7d8f4501e4bc55b5c117e9bb457f1c931 SHA-256: ea254a29bf2918c3f079e6db1fed43f7306198a067df8dc072ea5cb867cdd3b3
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, indicating it is part of a link farm designed to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this behavior, and the presence of multiple unknown URLs further supports this. While no scripts were directly extracted, the nature of the link farm suggests an attempt to redirect users to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=ghsa+football+study+guide
    • http://fisefer.22web.org/timutuwufule.pdf
    • http://lusanubi.22web.org/wedding_anniversary_wishes_for_sister_video.pdf
    • https://jigupeditu.weebly.com/uploads/1/3/1/3/131380623/kipuwegorenisijiwojo.pdf
    • https://gupolakeg.weebly.com/uploads/1/3/1/8/131871569/57aa26cd7ef5.pdf
    • http://mapugukabazewu.scienceontheweb.net/does_god_forgive_everyone.pdf
    • https://rogusedi.weebly.com/uploads/1/3/4/4/134433103/1661853.pdf
    • http://gobitujesan.scienceontheweb.net/changeling_the_dreaming_player_s_guide.pdf
    • https://vajunepiw.weebly.com/uploads/1/3/2/6/132681590/9638141.pdf
    • http://nikopexuvedafes.iblogger.org/fur_elise_piano_easy_sheet_music.pdf
    • https://wisenuru.weebly.com/uploads/1/3/1/8/131856959/mokutuvoputimi-mibukexipoke.pdf
    • https://lidutefavova.weebly.com/uploads/1/3/4/0/134012516/4cf70.pdf
    • https://vijekufimukij.weebly.com/uploads/1/3/0/9/130969895/48793ee5530.pdf
    • https://fuxexitir.weebly.com/uploads/1/3/4/0/134098624/54c2c25363.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/909147e5-76c4-4cb8-8500-8d3018e3874e/text_structure_worksheets_middle_school.pdf
    • https://uploads.strikinglycdn.com/files/ba094a17-c475-4744-b1cb-59269b1a604d/which_sat_biology_book_is_best.pdf
    • https://uploads.strikinglycdn.com/files/90293283-42ea-4b23-be7d-b43828d280fd/dolokagowevuzobegafab.pdf
    • http://topetovafaja.rf.gd/posenofewozovuxa.pdf
    • https://uploads.strikinglycdn.com/files/fe62ec7d-0dbf-4383-bc88-cc496f848cf0/can_i_use_my_dunkin_donuts_gift_card_online.pdf
    • https://uploads.strikinglycdn.com/files/efb6b010-0a9a-47c3-a889-3c1948a96716/rv_refrigerator_not_cooling_on_electric.pdf
    • https://uploads.strikinglycdn.com/files/d9e3e322-08a3-4470-ad9a-7778188ee104/how_much_does_a_navy_chaplain_make.pdf
    • https://uploads.strikinglycdn.com/files/b85abcbb-9b1a-475d-8687-f21561d4d609/fafomijo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017cf1.bin
cc2767faa29aec59df528a72b1f421adf041fdc4d61451c5ad6d38869fb16f09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17CF1 5344 bytes
font_01_sfnt_off00018f20.bin
daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18F20 1800 bytes
font_02_sfnt_off000197ae.bin
623643c7b3c343185e813249c84bdc40ffc3331c28f8b2bde6ac89eb88171e93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x197AE 11696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.