Malicious PDF — malware analysis report

Static analysis result for SHA-256 f284d09f09351070…

MALICIOUS

PDF

81.5 KB Created: 2021-03-15 13:08:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fc3f46fd9a67c72837bdd4925fa5c37a SHA-1: 5b0448edc954abe2b8e6547710d4f1cfc46c1958 SHA-256: f284d09f0935107073cb8a23d1f247a141a3be9296f307e568c1ac29b061b4d9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a large number of external links, including a link farm, suggesting a phishing or SEO manipulation attempt. The presence of embedded URLs and the overall structure indicate it's designed to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/wix?keyword=two+examples+of+diffusion+in+everyday+life
    • https://cdn.sqhk.co/nazalugewu/jcKgejc/dejumotenidesojexozu.pdf
    • https://cdn-cms.f-static.net/uploads/4474980/normal_5fe611e845d6a.pdf
    • https://cdn.sqhk.co/xilasexiki/mQgdy0a/stack_attack_dokkan.pdf
    • https://cdn.sqhk.co/xenumobavun/qZzicBo/72143304852.pdf
    • https://cdn.sqhk.co/widagawinud/gjj51hg/42085992853.pdf
    • https://cdn.sqhk.co/jodariwem/shaiahg/bidan.pdf
    • https://cdn-cms.f-static.net/uploads/4411001/normal_603b08f20d310.pdf
    • https://cdn.sqhk.co/someteku/EhQPid0/black_red_and_yellow_horizontal_striped_flag.pdf
    • https://static.s123-cdn-static.com/uploads/4375358/normal_5fcaad7783e75.pdf
    • https://cdn.sqhk.co/gazegarov/egfggjd/exoplanet_definition_example.pdf
    • https://cdn-cms.f-static.net/uploads/4488558/normal_6049842348b29.pdf
    • https://static.s123-cdn-static.com/uploads/4371261/normal_5fe349d1972c6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a2214900-82f6-4ed5-a432-d5ffd14110fa.filesusr.com/ugd/306b6b_dc2713586d664ebfb4bb9b1fb2cc9d41.pdf?index=true
    • https://f11c4bf2-12a6-49f8-9590-07a94b689168.filesusr.com/ugd/11276f_581f6d62c4d446cf9d107a225a0a405b.pdf?index=true
    • https://a121017b-3fb3-450c-9156-48dd71a9bf80.filesusr.com/ugd/07625c_737f07687a0e4545b0b66e326b0cc170.pdf?index=true
    • https://uploads.strikinglycdn.com/files/34a080ee-3163-49c6-a5ef-d200746d162f/the_types_of_engineering_drawings_used_and_how_they_interrelate.pdf
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_76f1f63b603d48dd825e139869666d7c.pdf?index=true
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_7201dfb66bee405fb0d1062f1cb269d8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/be830d89-678e-41ad-9003-b17426ed9f20/jugevixufufarukogemigofi.pdf
    • https://050a9d39-d8a1-4107-8be8-b2b70b72e454.filesusr.com/ugd/5262df_fb3f992d762f4fcfa254277557228839.pdf?index=true
    • https://728bf1be-24e3-4891-ba98-fedceca1a503.filesusr.com/ugd/3268c8_2812ead0fd9e43d98c68b87cc4a8c68c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/32bae50c-4c4a-436d-94a0-53af7c58c95c/56221779325.pdf
    • https://uploads.strikinglycdn.com/files/eb3c0b66-1bdd-4e2f-8279-fe36c79a1109/wahl_magic_clipper_parts_diagram.pdf
    • https://f87ce62f-3d5d-4c42-bff3-2e7d00444551.filesusr.com/ugd/72ed28_8d6be89c23b4455d900cd7ac515019de.pdf?index=true
    • https://d0bf7e8b-5449-41c0-93e9-161603c0719f.filesusr.com/ugd/197ed4_1150554bf4c74f3b8be602e0025fd17d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010229.bin
12825502a24bfdbb2befd401ff0d65f90f6d32daef9f21b7a44c009f634cab4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10229 5460 bytes
font_01_sfnt_off000114c5.bin
4926e8b52233b93c2207ed6a93bc549254d3a87f3ee22babb62c8c0986235a15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114C5 10508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.