Malicious PDF — malware analysis report

Static analysis result for SHA-256 0799461b63cd78a8…

MALICIOUS

PDF

84.4 KB Created: 2021-03-21 00:35:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04
MD5: 7ab8ba16847d3495d6652a681c2b43e9 SHA-1: 30331538119f01d1445e6de99a1d7dcb2a7d221d SHA-256: 0799461b63cd78a8f700cfcd6d9c8bc1a281ae7bc1ed7d83a129301c17fa3df4
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external URIs and is flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan. The document body, though heavily obfuscated, suggests a lure related to 'blackjack strategy', and the embedded URLs point to disposable domains, indicating a likely phishing or malware distribution attempt. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports the malicious intent of creating a link farm for deceptive purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=advanced+blackjack+strategy+table+pdf PDF link annotation
    • http://help-feedback-amzn8.xyz/70346112993anim0.pdfIn PDF document text
    • http://bluhgang.best/browning_hi_power_clonesay4gs.pdfIn PDF document text
    • http://ig-socialmedia.xyz/pavapifijnbj4h.pdfIn PDF document text
    • http://carbags.site/forest_wallpaper_full_hd_download_for_pc7p6d4.pdfIn PDF document text
    • https://gojatoxemoniro.weebly.com/uploads/1/3/4/8/134894745/leviwe.pdfIn PDF document text
    • https://dubelife.weebly.com/uploads/1/3/4/3/134379826/buririniwaru.pdfIn PDF document text
    • https://tuxitusonodedin.weebly.com/uploads/1/3/0/8/130873989/sixad_jixukexapanen.pdfIn PDF document text
    • https://dimegowogox.weebly.com/uploads/1/3/3/9/133999821/8adca398e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4378848/normal_5fcf49eae9429.pdfIn PDF document text
    • http://moresukko.ru/wegowupimiw9y3d9.pdfIn PDF document text
    • http://domavera.ru/8093396351oe66p.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366406/normal_6035d6217bb53.pdfIn PDF document text
    • http://thehensleys.org/what_is_the_difference_between_conservatives_and_radicals2ieeq.pdfIn PDF document text
    • https://wanowozuvigamo.weebly.com/uploads/1/3/0/7/130738859/pekopeweseloteb.pdfIn PDF document text
    • http://akfb.online/46952295732mno1y.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445343/normal_5fffbd02ce588.pdfIn PDF document text
    • http://ca-management.website/670383557q2bxw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393883/normal_602f9637b690a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462982/normal_5fe96197ed0f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388157/normal_60506170b9f7f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377679/normal_5fed12792b70f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387040/normal_600933947fd93.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/when_is_star_citizen_3.9_coming_out.pdfIn PDF document text
    • https://s3.amazonaws.com/zodererezuzuxi/sonogalefilonelare.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwuzerijofa/dozomoxixamiluli.pdfIn PDF document text
    • https://s3.amazonaws.com/leributafa/99953066315.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109BC 5756 bytes
SHA-256: 02192590d283fef7db9b938b3316b1ac1278da4b29717b7e87304564cd77d0a8
font_01_sfnt_off00011d6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D6F 11336 bytes
SHA-256: 97e2f66654af1c3d9f04d063d8af2e5e0964abfde44dfd03019afe273d7dd9a9

Open this report in the interactive analyzer, or submit your own file for analysis.