Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3bafccf77899b08…

MALICIOUS

PDF

80.3 KB Created: 2021-03-17 20:03:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 88dc0cc1a960283c69cbc058b8a2706e SHA-1: 71e52ec3da3822bfa439674c7f6362226773468e SHA-256: f3bafccf77899b08c098a01d064c21b416c03b0a6b048427c54519b130f98133
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a malicious intent to direct users to potentially harmful websites. The ClamAV detection and ML classifier further support its malicious nature. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a phishing or SEO manipulation attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=victor+sullivan+uncharted+voice+actor
    • https://cdn.sqhk.co/lotivadafe/ifjcifp/bevifuzanunu.pdf
    • https://robedovetukurur.weebly.com/uploads/1/3/4/7/134754045/6227930.pdf
    • https://cdn.sqhk.co/suwapipejob/aiafjjP/sodorenapanoba.pdf
    • https://cdn.sqhk.co/raxoxawupej/ehj4Hig/simulacra_found_phone_horror_mystery_free_download.pdf
    • https://gegotebure.weebly.com/uploads/1/3/1/6/131606057/6140193.pdf
    • https://cdn.sqhk.co/nebafaveju/Lyjhgju/line_launcher_tightrope_arkham_city.pdf
    • https://cdn.sqhk.co/rekosiseweno/dlhdhan/gumag.pdf
    • https://gugukufetufa.weebly.com/uploads/1/3/4/3/134337187/4045813.pdf
    • https://cdn-cms.f-static.net/uploads/4450721/normal_601e5dd920afc.pdf
    • https://cdn.sqhk.co/wamefuvew/iiexUih/auditing_standards_issued_by_icai.pdf
    • https://cdn.sqhk.co/fowonawex/gijhwtK/sagawekapubolojewowe.pdf
    • https://cdn.sqhk.co/furigelo/rWzibjg/xapevewelurodidedu.pdf
    • https://cdn-cms.f-static.net/uploads/4414871/normal_60170e9f281c6.pdf
    • https://cdn.sqhk.co/rojozedofaf/dDiehcD/mogak.pdf
    • https://cdn-cms.f-static.net/uploads/4412908/normal_60312e20dabfe.pdf
    • https://cdn.sqhk.co/fakodozug/jfgjqLB/nowajugir.pdf
    • https://cdn-cms.f-static.net/uploads/4413242/normal_60306689242d2.pdf
    • https://kuduxuke.weebly.com/uploads/1/3/5/3/135323303/9786657.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://roweviwumi.epizy.com/deadlift_program_spreadsheet.pdf
    • https://s3.amazonaws.com/zunaporam/wavafaxevapegisipe.pdf
    • https://s3.amazonaws.com/xalexojaxipud/sozumumotoxufejimep.pdf
    • http://lepijolunirug.epizy.com/livitaredefu.pdf
    • http://xatudoxi.epizy.com/63975097642.pdf
    • https://s3.amazonaws.com/sorapobuk/65511357733.pdf
    • https://s3.amazonaws.com/dupula/41140602377.pdf
    • http://sawutex.rf.gd/dyson_dc41_clogged_hose.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fca7.bin
49e25e65bb6d913d521f954b3a4d9ea77750eda941a5879325751c98bc8b8c36		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCA7 5052 bytes
font_01_sfnt_off00010dd5.bin
c3bf1dc7c446ac450692d8d90d9ae2bd8a9126c8ed8f28c9d5f21f1c863185ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DD5 11080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.