Malicious PDF — malware analysis report

Static analysis result for SHA-256 f53abd2f5a17c8c5…

MALICIOUS

PDF

82.0 KB Created: 2021-04-06 03:02:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a85a29a3629728afcdb6d09b59be312a SHA-1: d5ffbdf0f3805b4cc0d6dd396f7c4a68b9897a7c SHA-256: f53abd2f5a17c8c5c496c60b667003ee562868ff6b5d9c1f8a6a7723be6bb8bb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which are generated to appear as SEO-optimized content, suggesting a link farm or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a malicious document designed to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=candidiasis+oral+pdf+tratamiento
    • https://cdn.sqhk.co/vujenibolo/3hcgfnz/definition_of_corporate_strategic_planning_process_international.pdf
    • https://dolibaradodusop.weebly.com/uploads/1/3/4/5/134595809/28419297a2d.pdf
    • https://ditowesoxuro.weebly.com/uploads/1/3/4/8/134885058/napugolu.pdf
    • http://jiguvesowa.22web.org/bejuxedevizegaso.pdf
    • https://cdn.sqhk.co/reretukida/NJhj3hi/wuxederade.pdf
    • https://kovozewiridudu.weebly.com/uploads/1/3/0/7/130738567/d2aee.pdf
    • https://cdn.sqhk.co/dajebala/ox0hjhb/topps_match_attax_extra_champions_league_2019_20.pdf
    • https://zomogazafef.weebly.com/uploads/1/3/5/3/135348967/a681cd.pdf
    • https://dawemewi.weebly.com/uploads/1/3/4/7/134747996/viwululu.pdf
    • https://cdn.sqhk.co/bepotedaxus/CUhdbXw/sprint_stock_price_today_per_share.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/muvazi/ganalulivesefemarubam.pdf
    • https://s3.amazonaws.com/ropidadegaxut/nafavenowided.pdf
    • https://7f06b679-e14d-4525-8955-d56a7cf6f710.filesusr.com/ugd/79e5df_b41cbf9ab8944dd0aafb6de2524aaeb0.pdf?index=true
    • http://juwiwigepumer.rf.gd/biochemistry_basics_pogil_extension_questions_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/6007bc80-1f89-42e7-9938-303fd21d8cab/programmable_logic_controller_books.pdf
    • https://s3.amazonaws.com/varolexexus/brother_mfc-7340_toner_life_end_error.pdf
    • https://uploads.strikinglycdn.com/files/a2e1ada0-5c5f-48d4-ac2b-905287f5bccf/susaxunomilagikubanakuguk.pdf
    • https://s3.amazonaws.com/xugigabitulu/why_isnt_my_xbox_360_controller_connecting_to_my_pc.pdf
    • https://abaaaae4-9231-44fc-b12c-ad55ebcc68e7.filesusr.com/ugd/2ca09c_549379398323469583f8d0f7c2eff43d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f9146c79-a57c-426d-b163-b64702fdb8a5/what_is_the_best_green_smoothie_for_weight_loss.pdf
    • https://uploads.strikinglycdn.com/files/8ccf08ce-59d6-44cd-a656-7bd0eb19ef67/34630726548.pdf
    • https://s3.amazonaws.com/folexapurilowe/asking_for_information_email_subject.pdf
    • https://d0a6b1b1-1773-4622-8b5e-0ab5990a7ed3.filesusr.com/ugd/b90ba1_34a2ded63b0946c397f4468fa5de7343.pdf?index=true
    • https://uploads.strikinglycdn.com/files/88776d42-67ec-4c09-8b70-6eaebeadb5d2/pasimebepilu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000103d9.bin
d230c84208a9a0c35f9030fd51728c6b2620d1120bc4e816a3cb189105069155		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103D9 5092 bytes
font_01_sfnt_off0001150e.bin
6ef02d13110a28016b1039c9f57baa3fb9fdcb335853339ccd4e9ccd89ab35e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1150E 11468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.