Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed5fc1357ca3b978…

MALICIOUS

PDF

64.4 KB Created: 2020-11-17 17:08:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 0f4c75a926eb4d6aa0b220c6354f9551 SHA-1: 1cdc14f7e3892ff54b0cfdede0e32187b51083da SHA-256: ed5fc1357ca3b9786fa33b94d357409cb94ce2f9c7cc57ca4f6234d8097902a8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to Weebly and other hosting services, suggesting a link farm or phishing operation. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and extensive external linking are indicative of a lure to a malicious website, likely for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=everquest+mage+gear+guide PDF link annotation
    • https://bipinutafo.weebly.com/uploads/1/3/4/3/134358532/03e1aabe5273a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365649/normal_5f98790b3f4f5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406213/normal_5fa0720161e58.pdfIn PDF document text
    • https://sawifotu.weebly.com/uploads/1/3/4/5/134597463/tuvinolefes_vabeli.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385214/normal_5f9a4f5caee28.pdfIn PDF document text
    • https://jinezosibe.weebly.com/uploads/1/3/4/4/134454760/8e2533861736.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb2d0bc7-9334-4c2f-9bcb-b002f15babb1/36057636618.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74db8786-ae79-4755-848d-6d9b5afc306c/filemeduxajanuda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/696f1215-a5bc-4bc6-a220-634128979dd6/notice_of_interest.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42da6330-b0bb-4ea0-9c9e-196bc57da870/burililidiluvosupavufaj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bc0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC0C 5256 bytes
SHA-256: b364e4f848f99cfb2abd151a59fdbe3e998ef25510999ad7690c592b46e002a5
font_01_sfnt_off0000cdd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCDD3 11728 bytes
SHA-256: c64bd5a0fd498c57d65c209c09b97fcead39014b4653adc4a59067f5befe5831

Open this report in the interactive analyzer, or submit your own file for analysis.