Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff4d7ac540c473ae…

MALICIOUS

PDF

99.8 KB Created: 2021-03-23 07:41:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e743ab9967d540d3e07ddf2cf1ecbf3a SHA-1: 6477a555c08636bcbcb5ed6bbfae6e48dc0777cf SHA-256: ff4d7ac540c473ae1f9728c1ce850391babff322d62a2b29b9305c993042324c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, with one prominent URL pointing to a suspicious domain. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware delivery. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to redirect the user to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9966

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=ap+psychology+unit+1+review+quizlet
    • https://static.s123-cdn-static.com/uploads/4413846/normal_5fcb10b090181.pdf
    • https://static.s123-cdn-static.com/uploads/4413838/normal_5ff1c08655a1c.pdf
    • https://cdn-cms.f-static.net/uploads/4418184/normal_6056707a3be89.pdf
    • https://static.s123-cdn-static.com/uploads/4368469/normal_60065c3edf761.pdf
    • https://ligegumipiwefu.weebly.com/uploads/1/3/3/9/133999845/2743675.pdf
    • https://fejilexa.weebly.com/uploads/1/3/1/1/131163980/463047.pdf
    • https://cdn-cms.f-static.net/uploads/4444378/normal_6054e8483539e.pdf
    • https://pujuwofox.weebly.com/uploads/1/3/4/8/134882524/monejuduwuv-nonilo-ruwenoj-dibixugerijipa.pdf
    • http://zoxejusozowevo.iblogger.org/44618789158.pdf
    • https://static.s123-cdn-static.com/uploads/4366374/normal_600820a4769ba.pdf
    • https://cdn-cms.f-static.net/uploads/4383308/normal_6017d3b4813ef.pdf
    • https://static.s123-cdn-static.com/uploads/4393044/normal_5fdfbc65f0cfd.pdf
    • http://xususebixaxix.iblogger.org/rujilorudirojawa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xeropizuwe/how_to_pass_ap_physics_1.pdf
    • http://getorimojaz.rf.gd/labajotiburizemodiga.pdf
    • https://s3.amazonaws.com/wetowuzuxit/ryobi_2200_generator_spark_plug_gap.pdf
    • https://s3.amazonaws.com/zagapaxa/cascada_de_coagulacion.pdf
    • http://nizalag.rf.gd/bickley_script_let_font.pdf
    • https://s3.amazonaws.com/kukupunopedon/aptamil_gold_2_nutritional_information.pdf
    • https://s3.amazonaws.com/vatosolikijike/8478415799.pdf
    • https://s3.amazonaws.com/nademopor/death_note_light_up_the_new_world_ryuk.pdf
    • https://s3.amazonaws.com/levumoduf/94353159602.pdf
    • https://s3.amazonaws.com/bezegoluzose/apex_legends_quiz_answers_quiz_delivery.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8fb.bin
4ec285595b8a9d06670b30c7345773cec9ca7c088d77711f01aed2dc7c400a10		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8FB 6836 bytes
font_01_sfnt_off00010a45.bin
70b3bac5e73e4765ed0c0ea0d0f8f1a32226735c5722f278cad8b5210eed63ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A45 5456 bytes
font_02_sfnt_off00011cfb.bin
149b888408aa254ab0575c183ffd7409afac72dba5c5ee654a61ad341e146689		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CFB 9508 bytes
font_03_sfnt_off00013d9d.bin
dc53b71aaf0a57a327a5107933758ec79df0768e744c973acf503ee70895aee5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D9D 11124 bytes
font_04_sfnt_off000163a9.bin
3bd93e688f2993b27744791940e9fab5af40a74c6a71fadec7adfc8b757e4bc2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x163A9 16128 bytes
font_05_sfnt_off00017880.bin
5f7498f8e433e4c6c47e8ca53e78f46c92ad2660f1d70c8a76bf58ffa4fc47b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17880 1740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.