Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5652b4be9d4f8cc…

MALICIOUS

PDF

83.2 KB Created: 2021-03-17 01:26:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 990785628238225ea7f7c0445f151a86 SHA-1: 4aa1f51c7969976dc6a83c817c18135eee9e338d SHA-256: f5652b4be9d4f8cc473af4db3eae47e2354554e8f369cce022f35a4b90fcf397
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious and likely phishing-related. It contains a large number of external links, suggesting a link farm or redirection mechanism. While no scripts were explicitly extracted, the PDF structure and the presence of numerous external URLs indicate a malicious intent to direct users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=thailand+traditional+clothing
    • https://static.s123-cdn-static.com/uploads/4450244/normal_5fef65da78d09.pdf
    • https://cdn-cms.f-static.net/uploads/4489045/normal_600d49d90f24e.pdf
    • https://cdn-cms.f-static.net/uploads/4402519/normal_5fe8a4c41c598.pdf
    • https://static.s123-cdn-static.com/uploads/4413112/normal_5febbea9efecb.pdf
    • https://static.s123-cdn-static.com/uploads/4390081/normal_5ff426bfc3ed0.pdf
    • https://cdn-cms.f-static.net/uploads/4447089/normal_603abffccb46b.pdf
    • https://static.s123-cdn-static.com/uploads/4417414/normal_6001131cbbe0d.pdf
    • https://static.s123-cdn-static.com/uploads/4368999/normal_5fe5b975ec03b.pdf
    • https://static.s123-cdn-static.com/uploads/4470524/normal_5ff85f5b407dd.pdf
    • https://static.s123-cdn-static.com/uploads/4506131/normal_5feeac900dfce.pdf
    • https://static.s123-cdn-static.com/uploads/4408709/normal_6005743de2a66.pdf
    • https://cdn.sqhk.co/gawagunikuw/igggjgy/92204254825.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • https://73f4d879-981c-49fe-abc7-520f36a14a84.filesusr.com/ugd/b77b08_a3a96b83b08744c9a0b139deca73580a.pdf?index=true
    • https://b4095e1f-5e43-4c35-8b28-ff0c3185c247.filesusr.com/ugd/9cc3de_9d2b6414e1804366bda2dc7ca5d7aba4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/eb9e7a0e-47e3-4d0a-b766-19c63a1e2237/asus_rt_n66u_service_manual.pdf
    • https://uploads.strikinglycdn.com/files/481db07a-8c90-4320-893a-7a8fd5842beb/xiwux.pdf
    • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_0bbb25f618cd419389ce49f59de73012.pdf?index=true
    • https://80820154-e864-4b0c-832b-212b24169927.filesusr.com/ugd/c12414_c04aa03cb79340f88f064151b4e1dd52.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5c6c5430-8193-416b-bfd8-803b38da2c94/sowuzekaxegaxedakimimaz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5bc.bin
3fda7abb02da26d1c724cfcbb00cf38b5b433fbd82671f8efcb84f7906a68cf1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5BC 4972 bytes
font_01_sfnt_off0000f68f.bin
6be828b675e2cbef35a0aa8b79b93b044b3a4ec65e33c927ab9b52e402d60f28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF68F 11228 bytes
font_02_sfnt_off00011640.bin
1eb2a5528fc2f725f1f8dfcf07cc9ad9b28cea72084d7bfb7a26e00fa72e6e92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11640 12952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.