Malicious PDF — malware analysis report

Static analysis result for SHA-256 f77179d0d63cdec6…

MALICIOUS

PDF

76.7 KB Created: 2021-03-15 04:18:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 09173d82ba6f02cbcc11962629a00ab7 SHA-1: 1213c007ea0bad4cf4db16804d1e443b113819b0 SHA-256: f77179d0d63cdec6ed81e17b0a43d9aed0691849325aea52de0b0bac6a35b6d8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or SEO spam tactic. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of malicious activity, potentially leveraging embedded JavaScript for redirection or exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=who+are+twitter%2527s+competitors
    • https://metekazup.weebly.com/uploads/1/3/2/8/132815755/lesupuraruxete-jinomof.pdf
    • https://vukajikabazaxeg.weebly.com/uploads/1/3/4/7/134711597/vogek.pdf
    • http://waystep.site/club_car_wash_membershiprpmbl.pdf
    • https://sokifaxus.weebly.com/uploads/1/3/4/6/134666683/povib.pdf
    • http://ninotekega.mygamesonline.org/why_isnt_my_polaroid_snap_touch_turning_on.pdf
    • https://zokolukesowi.weebly.com/uploads/1/3/0/7/130776120/rujatetoberanif.pdf
    • https://cdn-cms.f-static.net/uploads/4446026/normal_603e26a3e5967.pdf
    • https://static.s123-cdn-static.com/uploads/4483349/normal_5ff4a2128f0ea.pdf
    • http://tabikola.online/how_to_fix_windows_7_using_command_promptm498q.pdf
    • http://obuv-kozha.ru/2006_chevrolet_malibu_ss_0-60yg6fm.pdf
    • http://xojuxelase.medianewsonline.com/cfa_level_3_curriculum_2020.pdf
    • http://theplafond.xyz/cortisone_shot_side_effects_in_hip591jg.pdf
    • http://lazerepil.site/linear_programming_practice_worksheet_answers6r1m8.pdf
    • https://jirilerimu.weebly.com/uploads/1/3/5/9/135967849/641617.pdf
    • https://cdn-cms.f-static.net/uploads/4458854/normal_5fea15b0b36ff.pdf
    • https://kavekoda.weebly.com/uploads/1/3/5/3/135326791/zovewakonov-narep.pdf
    • http://mamefumiwuto.mywebcommunity.org/ketilefiweroroneginikode.pdf
    • http://nanolenka.xyz/89724296944ro47o.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://voturugivorajop.onlinewebshop.net/pdf_file_to_jpg_image_converter_online.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efc3.bin
618984806e24aa043fb748be26d6dc8146b523e62e3042b9155f7515dbec1bcc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFC3 5280 bytes
font_01_sfnt_off000101ab.bin
423294ea547442230ab7bc56def1f2040dc3d064cb9ee824f8bc17e691276c23		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101AB 10480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.