Malicious PDF — malware analysis report

Static analysis result for SHA-256 edac1f941f18c400…

MALICIOUS

PDF

95.8 KB Created: 2021-03-22 22:14:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4b6151e88f18723b8200a6b4b8b34b5e SHA-1: b9d265a0c0a53cd79911974e625f27772bb3e6dd SHA-256: edac1f941f18c4008cad999d04e0041e502d82e6e04c292a84397efaa3b07f0a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a primary suspicious URL pointing to a domain associated with phishing and SEO link farms. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to a malicious site for credential harvesting or malware distribution. Although no scripts were explicitly extracted, the PDF structure and heuristic firings suggest it's designed to exploit PDF vulnerabilities or engage in social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=game+dev+tycoon+slider+guide
    • https://cdn-cms.f-static.net/uploads/4468531/normal_6051eada401a4.pdf
    • https://static.s123-cdn-static.com/uploads/4366666/normal_5fc76f19b5fad.pdf
    • https://cdn-cms.f-static.net/uploads/4366350/normal_605143e522b98.pdf
    • https://cdn-cms.f-static.net/uploads/4379723/normal_5fd7a6f9abfcc.pdf
    • https://kurixaxewa.weebly.com/uploads/1/3/1/3/131383664/nuvob.pdf
    • https://nolujamikudaze.weebly.com/uploads/1/3/4/8/134868466/f15ced05a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8928e8dc-1165-4d51-8845-53bcc5b6f436/16328763605.pdf
    • https://s3.amazonaws.com/wupiwupiwot/52475401456.pdf
    • https://uploads.strikinglycdn.com/files/29b122f7-57d1-45a0-99c8-435b8a42ceab/dapib.pdf
    • https://s3.amazonaws.com/buwosevax/diploma_template_psd.pdf
    • https://s3.amazonaws.com/metubevozisul/99_yamaha_timberwolf_250_for_sale.pdf
    • https://1ffb5d6c-d890-49e0-9b87-dc10fbfa49e2.filesusr.com/ugd/8bc2a6_8dc3bcb6edf4425089401c071a4adc3d.pdf?index=true
    • https://s3.amazonaws.com/jejulurowev/4757120948.pdf
    • https://b03e51a8-7171-48c0-94d6-e4c032e6f37f.filesusr.com/ugd/9421c8_fb6bda70da7240218a3b5c6df7aed4e4.pdf?index=true
    • https://s3.amazonaws.com/zuniverijesud/18499315980.pdf
    • https://50aad03f-9d2a-47e6-be13-abd12f321b17.filesusr.com/ugd/3fd638_4dfdc2bbb7a24bb09ac5a744d32134f8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3590e595-cdd3-4dae-bf6b-0674f9d46da5/xavowov.pdf
    • https://s3.amazonaws.com/jumedemimo/l2_revolution_hawkeye_guide.pdf
    • https://bcd7deca-fd5d-492b-a220-d373ca515bc9.filesusr.com/ugd/12f4eb_2cfe3e6785d7427fb14dae1f51b724c9.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001359c.bin
76ceba5d44a7918be3f0cf94165076fde7d00b1ebcf40f17a1b08d20c4a68206		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1359C 5452 bytes
font_01_sfnt_off00014822.bin
a5f60991b8d91eeada60cd02c07f272a042b965c43d35960f25046b0e049ade0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14822 12340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.