Malicious PDF — malware analysis report

Static analysis result for SHA-256 036c11ba94c55e77…

MALICIOUS

PDF

89.1 KB Created: 2021-04-18 04:17:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 672044977553cdce0f1c739272e5acfe SHA-1: 2fa778f0dedfa8941dfd993bbbd860a515dfd12a SHA-256: 036c11ba94c55e77cf0c63d4c55d48e10fb87e78ded3694eff1422560c7e2e31
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier indicating maliciousness. It contains numerous embedded URLs, many of which point to disposable domains and are likely part of a link farm designed to redirect users to malicious content. The presence of external URIs and the overall structure suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=integral+calculus+rules PDF link annotation
    • http://xujofalidubof.iblogger.org/vamironimubipor.pdfIn PDF document text
    • http://webpost.pro/743606318924s2my.pdfIn PDF document text
    • http://getcreditreport.info/20521883524rykk5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455185/normal_6013dfac75c0f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412575/normal_6003abe4674fd.pdfIn PDF document text
    • http://delalikifavaru.iblogger.org/zodudapo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369911/normal_60343e7f78f4e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fejakixoweka/bob_evans_breakfast_nutrition_facts.pdfIn PDF document text
    • https://s3.amazonaws.com/kezemiradigu/amcas_applicant_guide.pdfIn PDF document text
    • http://rojetakaju.epizy.com/10416516005.pdfIn PDF document text
    • https://d4078116-a2d5-466f-97e6-20d899f6ca30.filesusr.com/ugd/576447_26c702935e6d4cddbe804c8bb5637f75.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xeruxaxer/how_do_you_fix_a_loose_bobbin_case.pdfIn PDF document text
    • http://pejonoma.epizy.com/principles_of_cavity_preparation.pdfIn PDF document text
    • https://a121017b-3fb3-450c-9156-48dd71a9bf80.filesusr.com/ugd/07625c_c29214ba460a482b903d445106b7e152.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0936352f-2dc0-4e11-8b76-46119b374373/heart_of_darkness_summary.pdfIn PDF document text
    • https://s3.amazonaws.com/tarizirefevifab/brined_cheeses.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20260cf4-0d7e-4c61-8a22-148be9f917f3/how_to_connect_my_cloud_home_to_internet.pdfIn PDF document text
    • https://53860ffb-5975-4088-b838-5c82367c2827.filesusr.com/ugd/0d2908_e63e6e45c895489982b7b88c25bd23a2.pdf?index=trueIn PDF document text
    • https://e8c82854-2a0b-4c0f-82de-bac600ce06e6.filesusr.com/ugd/d017d5_32ac3fcf53ed41bcab0225df8c646ded.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/73041112-39ae-41ce-9b85-896113388fa9/coleman_battery_lantern_replacement_bulbs.pdfIn PDF document text
    • http://gulumejujuvutid.rf.gd/20793486050.pdfIn PDF document text
    • https://203aa715-7352-46b1-b16b-5d0aeeaa27a2.filesusr.com/ugd/0582e0_1cf71a3d2c5848fda7f4ce1c18ee5893.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/95bef63b-7117-4a52-8617-2bf4952fe474/72888067871.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011b74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B74 4904 bytes
SHA-256: d3edf2d974441051151ab03ddf3fff5489ea675afff89f1f5a57996b34b5e3c7
font_01_sfnt_off00012c32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C32 13392 bytes
SHA-256: 87b968ac03b45901fcd03dfc7010e26807bb1b0be8ce8bbec8d3fe8f843ad31e

Open this report in the interactive analyzer, or submit your own file for analysis.