Malicious PDF — malware analysis report

Static analysis result for SHA-256 f03d4856939a817a…

MALICIOUS

PDF

70.8 KB Created: 2021-02-24 14:01:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: dc2bbe7bb9f7fa624bb744ab0115510b SHA-1: d95ba9bdccb74304241af83d2ec014a983d665b1 SHA-256: f03d4856939a817abc2471150576003d5d6ac9f04df021b5661497da362fadbc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of a large number of external links, including a link farm, suggests an attempt to redirect users to potentially harmful websites. While no scripts were directly extracted, the PDF structure and embedded URLs point towards a phishing or content-luring attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wb?keyword=what%20is%20operations%20management%20ppt PDF link annotation
    • https://kuvutokejutal.weebly.com/uploads/1/3/0/8/130814176/lulamufavil.pdfIn PDF document text
    • https://cdn.sqhk.co/wadelovelo/ghtz1ic/coloring_ben_hero_cartoon_network.pdfIn PDF document text
    • https://cdn.sqhk.co/zojixemem/eHgf3je/the_bow_rack_redding_number.pdfIn PDF document text
    • https://cdn.sqhk.co/kawiwitifa/ahiHBjb/75743915966.pdfIn PDF document text
    • https://rulomegujenuguv.weebly.com/uploads/1/3/4/3/134329868/figefasoxoj-fuguzafubuti.pdfIn PDF document text
    • https://cdn.sqhk.co/domuduxuro/q4yjh0V/cloth_face_masks_made_in_usa_for_sale.pdfIn PDF document text
    • https://cdn.sqhk.co/gujowaxexag/5iwqhdQ/66696124919.pdfIn PDF document text
    • https://cdn.sqhk.co/baluwofuk/J2jcJG1/11859855221.pdfIn PDF document text
    • https://cdn.sqhk.co/jojevirelo/ZOz0hd0/now_100_hits_power_ballads_cd_covers.pdfIn PDF document text
    • https://cdn.sqhk.co/futevanu/jjdjcM8/95719439.pdfIn PDF document text
    • https://senevabitup.weebly.com/uploads/1/3/4/2/134234896/8358512.pdfIn PDF document text
    • https://cdn.sqhk.co/nananava/qggjdje/movie_creator_mac_free.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490274/normal_5fe3fb78271da.pdfIn PDF document text
    • https://sopebanodi.weebly.com/uploads/1/3/4/0/134017095/1382464.pdfIn PDF document text
    • https://cdn.sqhk.co/derilunadine/AMUqEic/nupefulofovigat.pdfIn PDF document text
    • https://cdn.sqhk.co/febapaji/h5iijj4/ziwubebetisetitexumi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/poguvelefa/lobimir.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8D7 5212 bytes
SHA-256: 74f53192cb6d8054447dbaa6f565f7f646756a16bdc41ad0c2cde5628e3bc94f
font_01_sfnt_off0000ea76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA76 10580 bytes
SHA-256: e8a1ccd4226f6f24e3fd6d74e190110579317d7cfcb3e0f15d597b21a357ef5f

Open this report in the interactive analyzer, or submit your own file for analysis.