Malicious PDF — malware analysis report

Static analysis result for SHA-256 02a53b8920cdb45b…

MALICIOUS

PDF

70.9 KB Created: 2021-03-17 23:39:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 76a4e84d9d268b5854ab8030f8572f14 SHA-1: d9cd4da45c8ee4d3195f4737e954b4286d050edc SHA-256: 02a53b8920cdb45bdfe264c4d8c4b1964734c9b4cb003d05e0e6488a388254c2
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded links, one of which points to a suspicious domain associated with phishing. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to a book summary, likely intended to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9665

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=hillbilly+elegy+summary+pdf
    • https://cdn-cms.f-static.net/uploads/4453335/normal_60150eb0bc90f.pdf
    • https://wefupavoxed.weebly.com/uploads/1/3/2/6/132682659/tepuzijifokowat_totajojeb_zonodazu_madojabu.pdf
    • http://reznitskygallery.com/spotify_online_erw0w4m.pdf
    • https://cdn.sqhk.co/zogobadakedu/wnLvThe/15938185493.pdf
    • https://dugitesabisaxo.weebly.com/uploads/1/3/4/3/134392589/koxafiku-dekozabeza-mazunoke.pdf
    • https://static.s123-cdn-static.com/uploads/4420430/normal_60012aafa4326.pdf
    • https://static.s123-cdn-static.com/uploads/4365606/normal_5fe1b9cc426d9.pdf
    • https://cdn.sqhk.co/rolileduvof/ZghnbFB/downloader_and_private_browser_pro_apk_free.pdf
    • https://vatenesarawe.weebly.com/uploads/1/3/0/7/130775606/4599258.pdf
    • https://cdn.sqhk.co/kepigofunet/dUggWij/custom_notification_ringtone_android.pdf
    • http://trafikcezaodebayisi.com/bimesipunenes86mk.pdf
    • https://cdn.sqhk.co/nogedapuvul/jdggh1l/35280440998.pdf
    • https://cdn-cms.f-static.net/uploads/4446395/normal_6009f07f3c135.pdf
    • https://cdn-cms.f-static.net/uploads/4450641/normal_6040fab3d8ae0.pdf
    • https://static.s123-cdn-static.com/uploads/4466146/normal_5fc7d1ecc09f1.pdf
    • https://pubategikosiw.weebly.com/uploads/1/3/4/1/134131453/jazeguzi_waresaza_kipew.pdf
    • http://ig-copyrightviolation.com/best_ringtones_download_bgmvzuf4.pdf
    • http://tells.fun/a_guide_to_rational_living_free_downloadyafzg.pdf
    • https://cdn.sqhk.co/ninituraxasu/wjfYuid/26648369497.pdf
    • https://jogelobob.weebly.com/uploads/1/3/5/9/135961552/luvesewujewamiz-zemibaboda-jojivij.pdf
    • http://dlkmvkoenv.info/words_that_start_with_strlg9wd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c5bf8135-86cf-4d7c-80d5-3ff06ee4ee95/how_to_reset_the_toner_light_on_a_brother_printer.pdf
    • https://uploads.strikinglycdn.com/files/83f53610-5d41-4d60-a395-a41558c9e113/bt_notice_app_for_u8_smartwatch_download.pdf
    • https://uploads.strikinglycdn.com/files/813ec180-2918-41e1-81c4-2de341dd3c63/john_deere_110_backhoe_for_sale_washington_state.pdf
    • https://uploads.strikinglycdn.com/files/afdb6c99-d790-40a2-abb6-2300d7cf1657/tojasesomelafikawiwogave.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6f0.bin
7703f3aeec9edf9b2c570b4e1eec2e771e81cf858f10278c9cbd1a983c25f07d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6F0 5564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.