Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed9c5971edbb323f…

MALICIOUS

PDF

82.1 KB Created: 2021-03-21 22:58:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 2b16b14d72e0ca13787eea3169c588ad SHA-1: 9c5924a0e5df977c4f262b68ae4cf0afd2d76733 SHA-256: ed9c5971edbb323f17121984e3b900fcaa738586b2ac7032992ecbeb24527101
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=presentation+signpost+expressions+pdf PDF link annotation
    • https://tamexixufose.weebly.com/uploads/1/3/0/7/130739892/wuzusugolikija_jamalaka_zixurur.pdfIn PDF document text
    • https://kamenibez.weebly.com/uploads/1/3/4/7/134727972/madigakuzela.pdfIn PDF document text
    • https://xukonixivuki.weebly.com/uploads/1/3/0/9/130969652/493a8c.pdfIn PDF document text
    • https://cdn.sqhk.co/dewufidabo/hbIiaVo/texas_longhorns_basketball_roster_2017.pdfIn PDF document text
    • https://nogigeto.weebly.com/uploads/1/3/4/6/134665346/nivevoba_toviginuvuni_rigewe_kekuzogarovor.pdfIn PDF document text
    • https://cdn.sqhk.co/kixobaza/geROSji/povufulovitudobax.pdfIn PDF document text
    • https://nimuneroz.weebly.com/uploads/1/3/1/4/131407882/mezesajadotuxozem.pdfIn PDF document text
    • https://cdn.sqhk.co/tosilura/ql3jdoV/north_phoenix_news_today.pdfIn PDF document text
    • https://cdn.sqhk.co/nipumusawobo/8jjh34r/traffic_racer_game_free_download_for_android.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://a12a05ab-6462-4855-b086-b0a2a961d6d8.filesusr.com/ugd/2c76f4_1cdfcaa6d1044bd08ab84ef9e2b9569d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tojabixefova/las_mujeres_que_aman_demasiado_precio.pdfIn PDF document text
    • https://5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com/ugd/2e16aa_078c1bd394004d03bcbc6ae483a7409a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wujafivabipo/36749978739.pdfIn PDF document text
    • https://s3.amazonaws.com/sefukirexuwekij/relion_oximeter_instructions.pdfIn PDF document text
    • https://s3.amazonaws.com/geraromu/23884482545.pdfIn PDF document text
    • https://s3.amazonaws.com/towakog/miui_themes_app_for_android.pdfIn PDF document text
    • http://vamudeb.epizy.com/tuzatovule.pdfIn PDF document text
    • https://s3.amazonaws.com/fizaxo/11828135726.pdfIn PDF document text
    • https://6478d21b-237c-41b5-add8-96d7b9819624.filesusr.com/ugd/c7ef1a_b891e6df98af4974bb3363afe5bba258.pdf?index=trueIn PDF document text
    • https://9ffa65b4-b95e-481c-977d-2cf6acaa57d7.filesusr.com/ugd/f68d46_de3b5b6b1fa842fdb9019ec75719dec8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zumezeviwakiz/basic_english_grammar_practice.pdfIn PDF document text
    • https://4bc473c2-84d0-4913-8b4e-281bf44fba2e.filesusr.com/ugd/a25dbd_733b9b8d1c1b40d895a1a9f525f7b7c3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bejeseja/45758609847.pdfIn PDF document text
    • http://dusuwuf.rf.gd/spike_heels_theresa_rebeck.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ffc9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFC9 5248 bytes
SHA-256: 9e3c16b54197f42a101710283a368a573b82dbe4c695e12dbc1b698a75b17f39
font_01_sfnt_off000111ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111BA 11540 bytes
SHA-256: ee86c61eba8b4a6e0facde35895d4f3dd031fb5116e2f34e46f38ad8a5b7f112

Open this report in the interactive analyzer, or submit your own file for analysis.