Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc14199c7c3d43ab…

MALICIOUS

PDF

74.9 KB Created: 2021-03-15 22:35:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9bdd2258f49ded16dda565f277e3a9e9 SHA-1: d5c44e2009f5f33a0c26d8f457eb7dbc6ec18b99 SHA-256: fc14199c7c3d43ab262f4eae2142f962cc4d4724e67d3fa1403bed0d8f1b7425
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains a significant number of external links, with one identified as a potential phishing or malicious site. The PDF_SEO_LINK_FARM heuristic suggests a deliberate attempt to manipulate search engine results or direct users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=rca+rts7010b+power+cord
    • https://static.s123-cdn-static.com/uploads/4367643/normal_6001cfd0313d4.pdf
    • http://latencfsrt.space/samsung_js8500_hdr10yolyf.pdf
    • http://politach.com/12138794346li2hu.pdf
    • https://cdn-cms.f-static.net/uploads/4481834/normal_60397b045bd2d.pdf
    • https://cdn-cms.f-static.net/uploads/4369308/normal_60243b55bd2b8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/625b5ecc-d46e-4931-8ba2-41a60893e6e9/best_software_development_company_names.pdf
    • https://uploads.strikinglycdn.com/files/0500ace1-765f-4729-a839-cf062903914f/huck_finn_chapter_15_audio.pdf
    • https://5366dd3f-28a3-4342-b8e5-5bed86455aec.filesusr.com/ugd/a92322_e547e2ade44d4aefa9b83791588c2a0a.pdf?index=true
    • https://5e54d98c-4257-4cc7-9010-48f3df296eb2.filesusr.com/ugd/05240c_0d94575d959a4f2fabf75cb3b721860a.pdf?index=true
    • https://aee666f7-65d2-4416-8089-42e5bd85255d.filesusr.com/ugd/c4036c_535e11c399b247cab937b174ea1471c5.pdf?index=true
    • https://f07eb630-23ff-4298-a1df-d7940f1ba2dc.filesusr.com/ugd/097a5b_1c5b6763d77e4490874908be5e90d080.pdf?index=true
    • https://07e0a16e-b77d-475b-b724-88bbaedb347c.filesusr.com/ugd/8e9e2f_38b6a091a6f34944a77bbf23d7d99e83.pdf?index=true
    • https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_4dc25addefd34d8487e0e4ce3b975d13.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bd9ebc16-d163-4132-bb16-69710ae0519b/kexomonewinogaxati.pdf
    • https://c7bff75e-0a19-4817-9d47-fca4cf08161b.filesusr.com/ugd/3b6424_b32f514f3d354decb416875550353b30.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a1fd6c22-fea0-4080-b1c0-796ae43dc64c/do_baby_bjorn_bouncers_ever_go_on_sale.pdf
    • https://38aad9b5-7a72-45b8-ac81-9fe73ce82000.filesusr.com/ugd/08338c_894cf63d87474e53a1cc1d5ff002af3d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d94e.bin
246b6f520f29476cadb5845a0b0227f25b99480050696d0a2d9e5bfef32acde7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD94E 5180 bytes
font_01_sfnt_off0000eb0b.bin
eb68078af5ce35c0db2709ff49872e259b7845405ab263d614e0659714161de8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB0B 10996 bytes
font_02_sfnt_off00011073.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11073 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.