Malicious PDF — malware analysis report

Static analysis result for SHA-256 03d2249ed68fe48b…

MALICIOUS

PDF

106.3 KB Created: 2021-04-16 07:33:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 6d5758717726f7a24aabcad96033e8db SHA-1: b7898836ae9e26af455b97a588327beeb8d99016 SHA-256: 03d2249ed68fe48b86f91f43c9d4dbb6cf880c39cc2737962d99c04eb1efd3a1
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with one specifically identified as a malicious lure for a game codex download. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to a phishing or malware distribution site. No scripts were extracted, but the presence of numerous external links and the heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggest a phishing or spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=astra+militarum+8th+edition+codex+pdf+download+vk PDF link annotation
    • https://kedixusivazusug.weebly.com/uploads/1/3/4/8/134869684/sokidiberefati-masebalosowikig-jifalokole-lepetuluf.pdfIn PDF document text
    • https://rukadewij.weebly.com/uploads/1/3/4/0/134012321/210415.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443357/normal_6023cc7e21014.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384825/normal_603f666557006.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482648/normal_5fcb049b9f3a9.pdfIn PDF document text
    • https://gikotibosad.weebly.com/uploads/1/3/4/3/134332820/rixegijul.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387715/normal_600ba211c9419.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421612/normal_606e35167f2bc.pdfIn PDF document text
    • https://tidijesugeji.weebly.com/uploads/1/3/4/7/134764535/zaxofebexap.pdfIn PDF document text
    • https://luwanolukurodo.weebly.com/uploads/1/3/5/3/135397368/jinavam_tekufedevoxeg_nasesinumuku.pdfIn PDF document text
    • https://viremekim.weebly.com/uploads/1/3/1/4/131407965/5d05193ba.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/3d04f4f9-41d1-4c0e-8c46-39e17524bc0e/winding_walk_clubhouse_chula_vista.pdfIn PDF document text
    • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_f4cfe002083c44d39158d9845bc593bb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1319512b-780f-4a6b-975c-84a95540d02d/73100871808.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a84a6790-d50d-446e-b0c7-dcaa1f1dcaba/52933856694.pdfIn PDF document text
    • https://5d55c623-01b0-417f-8131-8dfd0334080c.filesusr.com/ugd/9ef046_4b7c12736bd34beea317be0db036b742.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e06ca4ef-bf72-4bc0-a7cd-ac939e712491/viwediwosujidolakiji.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb5a81fe-8f7a-4505-9426-3bfd71d49fe3/brother_hl_5470dw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97fbc5ab-0ee1-4cfe-96f3-731c8e9038e3/is_there_gonna_be_a_season_4_of_under_the_dome.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC03 3692 bytes
SHA-256: 2d4af7c924190e1750e090ecbb25752962050c3d97bcf923cbd306d0793e513f
font_01_sfnt_off00010909.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10909 5744 bytes
SHA-256: 126034fd6dea9bd56ca54fd1412cdb9a91aeba91ec9cfccf2116a566c034ad4d
font_02_sfnt_off00011c43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C43 6300 bytes
SHA-256: 2db417d64f20d08253b89c050a853a133749dbd85a924c6c737e30cc37887664
font_03_sfnt_off00012bb6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12BB6 18592 bytes
SHA-256: db51f3859437ceadcd9b127258066b0349c9f89b39bb83e38a10258012d5a5d0
font_04_sfnt_off00016371.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16371 16552 bytes
SHA-256: c12558cf6821a2f1a1ac9c3af527413882105e37435a71372703c7035d6ce2bf
font_05_sfnt_off00017a0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17A0B 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e
font_06_sfnt_off000187cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x187CD 6204 bytes
SHA-256: 354da8139de5a773a161974208edaf4598b3ce0e0547fe532f39dc78129918cc

Open this report in the interactive analyzer, or submit your own file for analysis.