Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea56e138b506519e…

MALICIOUS

PDF

71.2 KB Created: 2020-12-09 12:07:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: b24cada4d7047bae8d15b8c81957bc1d SHA-1: bfb82eff43af13c14639a7de6a5dd3ff686fe2fb SHA-256: ea56e138b506519ead81c6b910420bf959c6026cdda55f0eafb6dedaafe13234
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains a large number of external links, many of which are likely part of an SEO farm or a phishing campaign. The document body, though heavily garbled, contains text related to 'process improvement templates free', suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=process+improvement+templates+free PDF link annotation
    • https://pasiwuguvode.weebly.com/uploads/1/3/4/6/134601834/294f47a4fbbe86.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc5a84892c50b1a1e97e4fb/t/5fce89c04f39131e41824d2d/1607371203146/the_sims_mobile_mod_apk_terbaru_2019.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc71a03f784ea51367e4fba/t/5fcea77dca1f943ff59f0318/1607378814553/33240931382.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc79565504bb4653ce62487/t/5fc8e9c0b5c0dd03ebd2ecc6/1607002561071/75078112899.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1999f5e8e827d4292cb4b/t/5fc281249b1ed035382d5e70/1606582565058/5699717510.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc19cf9bdb33045eec75325/t/5fcddc4d33187724c4139cb5/1607326799124/rafupotakuwobororeratajal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae15c4ad-c07c-4024-85b3-0584598cb5b4/92602595331.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ddc77d1e-98a2-46b4-898d-ff0187a39911/if_i_stay_book_online.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0b544c89e1c4b8fbd6471/t/5fc13f3f4f983757200d2359/1606500159964/low_cost_strategy_advantages_and_disadvantages.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0d446ab79f442f2293e00/t/5fc1067f3c6ccf69f3820d8a/1606485634918/max_principal_stress.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4e3c612facd59cec67b06/t/5fc65c4a61e25426e11137dc/1606835277510/wenatimonomonovebav.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce45288eda244dc4acbbd2/t/5fd02d61ef76c20f2d3f9a0a/1607478625849/international_business_management_salary_in_canada.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5add9f9866f3fd2f487b8/t/5fcf1b5701eaf4591e2289bd/1607408473737/shooter_of_metal_run_gun_mod_apk.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5cbbe104edf1d77a2c1c8/t/5fd02029ef76c20f2d3d5936/1607475241344/botetezotetakun.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc16c3d6b97992eb55fb768/t/5fcaab8b538ea9548d97914c/1607117709021/54003201644.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d9c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9C7 5220 bytes
SHA-256: 0a76226d8771c94c7e246888e9b4cccc6b633241c3fc6fd5596ad6d4a3ea91e5
font_01_sfnt_off0000eb7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB7B 10760 bytes
SHA-256: 31f735b64b7416e9a2b79f6eb552889cc3ea08a41171fd729847214befcd0a18

Open this report in the interactive analyzer, or submit your own file for analysis.