Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4f0a648270a63b8…

MALICIOUS

PDF

70.6 KB Created: 2021-03-18 20:04:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 59848bf60410c39533db5e261ae967b0 SHA-1: cd18c15cbbff4d32fe464091efc7fa8dbaf01e97 SHA-256: f4f0a648270a63b8eb25c7092a5d3154fc131ecada5551909bf9c3d7128163c5
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are hosted on domains commonly associated with malicious activity (e.g., cdn.sqhk.co). The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, likely to distribute malicious content or engage in SEO manipulation. The presence of a download button lure further supports a phishing or malicious download attempt. ClamAV also detected this file as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/123?utm_term=berkheimer+tax+forms
    • https://cdn.sqhk.co/nupodamukoji/Rgjagi3/standard_html_email_template_size.pdf
    • https://cdn.sqhk.co/pegidago/tKPLhjw/action_launcher_pixel_edition_plus.pdf
    • https://cdn.sqhk.co/binimazov/aifjcig/bibliographies_in_apa_format.pdf
    • https://cdn.sqhk.co/tononapiwaso/dKijq45/fukowiguduwo.pdf
    • https://cdn.sqhk.co/dezorevukor/jghhjfS/huawei_launcher_apk_2019.pdf
    • https://cdn.sqhk.co/manigonodapu/bId6p06/mad_8_heroes_battle_apkpure.pdf
    • https://cdn.sqhk.co/porekige/HpKHBgg/87279408659.pdf
    • https://cdn.sqhk.co/kominepoli/QSjihid/grampa_grampa_vs_zombies_2.pdf
    • https://cdn.sqhk.co/nogorodizet/iKhgaij/primitive_survival_net_worth.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fuwenoxuzasila/nice_guidelines_family_history_breast_cancer_screening.pdf
    • https://s3.amazonaws.com/vojapu/pevovosivoviloruguf.pdf
    • https://uploads.strikinglycdn.com/files/353978af-7746-4722-9827-ddd6bb817447/70129839449.pdf
    • https://s3.amazonaws.com/dosipive/cisco_sg300-10p_manual.pdf
    • https://s3.amazonaws.com/fovezewi/47541720377.pdf
    • https://uploads.strikinglycdn.com/files/5e57c9a6-12a0-454d-8f74-3410b96a5766/90244089036.pdf
    • https://e3055f73-6236-423b-b810-4bc1a15f300f.filesusr.com/ugd/fa12d1_6199b6b86881494eaa929686234635c4.pdf?index=true
    • https://acd80754-3b70-42c6-a60f-3489f6261da4.filesusr.com/ugd/f1780b_62331b537fb34892b77b4001573e8bcb.pdf?index=true
    • https://2ffa788b-df2f-461f-b9c5-573bec542745.filesusr.com/ugd/374ce0_26b61d0fd15944ff8707a782710bd7c6.pdf?index=true
    • https://6bc61794-ec17-45f1-96eb-8bed4cd57308.filesusr.com/ugd/217b8a_a0c32ef897ce47c0a01adcaf993313a1.pdf?index=true
    • https://9eff4bf0-55a5-42b9-a65a-250f23c32afd.filesusr.com/ugd/80978b_98f6a015f26c4813a4941e4f5cd5aa1d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c0ce4034-0276-4491-b22d-e9f2ae745bad/87801604158.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6f3.bin
d33e4acc3ee33bb83c5856a63e1dbc119b9cbee7e00e6be937766d458d2f996f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6F3 5156 bytes
font_01_sfnt_off0000e85a.bin
c3b313e5860fda7fea3218e9c40b8f37c1e76c77be4696229906210fee9eabc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE85A 10852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.