Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe4081fa2addbc22…

MALICIOUS

PDF

77.4 KB Created: 2021-03-18 15:19:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 462ec209a9b2670e268440bfbca5200b SHA-1: 74199d441e78d32075af7d9c71421bd5479ecdb8 SHA-256: fe4081fa2addbc22db82d5de0700ecf540f269d248b97b22ead530470bfddc9a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded links, with a critical heuristic identifying a large number of external PDF links, suggesting a link farm or phishing attempt. One of the primary external links points to a URL that appears to be part of a malicious campaign. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=honda+odyssey+trans+fluid+change
    • https://cdn.sqhk.co/nilamemiw/xKdgcjc/48885916473.pdf
    • https://cdn.sqhk.co/sekigizakeku/1JdOjfl/13673201228.pdf
    • https://cdn.sqhk.co/fejisunez/ZF7Pq0T/rotamusukoponekarube.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tininababa.rf.gd/75012544320.pdf
    • http://vezuzatutuxi.epizy.com/phrasal_verbs_exercises_upper_intermediate_level.pdf
    • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_dca9985c9c0a485ba0db6d79be234366.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6d3aa546-b08c-47a8-a758-a6496f60054d/51437808311.pdf
    • https://s3.amazonaws.com/makixibawumebol/37214357392.pdf
    • https://s3.amazonaws.com/gurowozenupifi/54876943532.pdf
    • https://s3.amazonaws.com/tiluwisulepam/tezojowisuvizalobina.pdf
    • https://uploads.strikinglycdn.com/files/39de7142-39b1-401f-b077-98d1b95c3842/chris_stapleton_new_songs_2019.pdf
    • http://wivufakumetewiv.rf.gd/mastering_the_art_of_french_cooking.pdf
    • https://uploads.strikinglycdn.com/files/5093c32b-9f12-48bb-be8c-3ca86a211a6d/sony_bdp-s3100_amazon_instant_video.pdf
    • https://68358877-4ee6-4e53-94f7-4bd9665c1f53.filesusr.com/ugd/3bbd68_8224cfe92a314bd4a4205c7bafec197a.pdf?index=true
    • https://571cbd0a-ba82-408d-be6d-2df53a8fcfe5.filesusr.com/ugd/02af14_675efa5aaca342c49e7b794441917568.pdf?index=true
    • https://6db1e9a2-4282-4636-8d41-de07325ad911.filesusr.com/ugd/d97b38_4df2665fcc734eaba8d103bd5f8b27ea.pdf?index=true
    • https://601bead5-a720-4f65-98db-62fe2a42cb91.filesusr.com/ugd/0e52b4_1b2aa2ec695c48fd99b7f7188ae2f48e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bc3cf465-cca4-4427-89da-eae02b2846d4/vuxebexub.pdf
    • http://kifowagumapoz.rf.gd/what_is_sat_test_meaning.pdf
    • https://s3.amazonaws.com/xasovewipeje/appvn_apk_free_latest_version.pdf
    • https://uploads.strikinglycdn.com/files/c16414a3-1c91-475a-bc7e-50b8dba3e320/honeywell_k4392v2-h_change_battery.pdf
    • https://uploads.strikinglycdn.com/files/1f57f107-422b-4f75-a83a-1e1964e528f6/76096145407.pdf
    • https://uploads.strikinglycdn.com/files/a4a166c9-5925-4dfc-a905-3673f097925d/who_makes_the_best_manual_locking_hubs.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2c1.bin
e16657481ad3ad1dbd880115e20a8bdbf2703c12eebd4c423bb438de0a0e6e51		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2C1 5348 bytes
font_01_sfnt_off000104f2.bin
610fcaf1110c65ef659bb7af7125a02cefa17dbc15ce9a07f268516dce3f0974		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104F2 10344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.