Malicious PDF — malware analysis report

Static analysis result for SHA-256 03dc5d19dd187264…

MALICIOUS

PDF

79.1 KB Created: 2021-03-19 10:31:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 19c35823e41e403561f53f150d29cf01 SHA-1: 1037e5deb7dec7ef7b067be52266e7784254b1f3 SHA-256: 03dc5d19dd187264262add7c85459b0a94b9adb1df17d02e671946b2fada3edf
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with several pointing to unknown or potentially malicious domains, indicating a phishing or malware distribution attempt. The 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic further suggests a deliberate effort to create a large number of links for malicious purposes. ClamAV detection as 'Pdf.Phishing.Trojan' strongly supports a malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=caballete+definicion+pdf
    • http://fdvsefwfrw.space/ainsi_va_la_vie_max_et_lili92t7b.pdf
    • http://reduslimitalia-oficial.site/beetalk_ios_2._3._6lih64.pdf
    • https://cdn-cms.f-static.net/uploads/4365584/normal_6050eb6b98940.pdf
    • https://cdn.sqhk.co/burajugi/gcjjhhR/marooned_with_ed_stafford.pdf
    • http://beach-fruit.fun/best_android_radio_app_ukc2u8o.pdf
    • http://bowemesuzot.iblogger.org/d_d_character_sheet_app_5e.pdf
    • http://sandiego-podcasts.com/derecho_procesal_civil_publico_o_privadoggn11.pdf
    • https://cdn.sqhk.co/lizupasepafu/7hdLgiz/ice_cream_truck_song_music_box_dancer.pdf
    • https://cdn.sqhk.co/vozedolurezu/jEX3gcc/alaporan_tamilan_lyrics_video.pdf
    • https://cdn-cms.f-static.net/uploads/4452594/normal_600c8d4c6184c.pdf
    • https://cdn-cms.f-static.net/uploads/4367302/normal_601ec2feaa55b.pdf
    • https://cdn.sqhk.co/sivadapexiri/c0Whcge/best_tower_defense_warcraft_3.pdf
    • https://static.s123-cdn-static.com/uploads/4375351/normal_5fcf340141649.pdf
    • http://1ux.site/tet_paper_2_psychology_study_material_in_tamilks5fm.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7ed754b6-a209-4558-9281-0032c7ee8ade.filesusr.com/ugd/4329d7_779c0b6908dd45dc86fe2c61f5d6d2b4.pdf?index=true
    • https://0503187d-52cd-4237-9521-a3cb9bf551ae.filesusr.com/ugd/5bb01c_1d9b2ed502e941f5a1bb5487aca0128c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ab607d42-0131-422d-9f8c-5e44d6d7261c/88545535234.pdf
    • http://jozixal.epizy.com/deposition_objections_california.pdf
    • https://uploads.strikinglycdn.com/files/28baf43c-abaa-48cd-ae98-86ca8c47d307/47048505028.pdf
    • http://lazavosapazogil.epizy.com/most_popular_spanish_words_in_english.pdf
    • https://uploads.strikinglycdn.com/files/41d697f0-cabc-49cf-b57a-5d12ad3b9a84/how_do_i_get_rid_of_line_breaks_in_indesign.pdf
    • https://ba30dffa-51fe-4caa-9472-6f142403a9bb.filesusr.com/ugd/c2007e_2d375485af9e47cca64ea57607d0adfe.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f364.bin
b285d3a2c2cd4df0692db388c7989f7059af677f2fd38b61fdabf4600ffcbed6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF364 4920 bytes
font_01_sfnt_off00010431.bin
95549524dfaf6ff5e2c57fb5e6c50aac249e056c925122782bf789c27bccd7ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10431 12896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.