Malicious PDF — malware analysis report

Static analysis result for SHA-256 07c373f3e23dfdde…

MALICIOUS

PDF

95.2 KB Created: 2021-04-03 01:24:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 469e37cf653976aa085ed87774d23b27 SHA-1: d44b9b50718e15010bab4e4f9d14ba18c6bab142 SHA-256: 07c373f3e23dfdde1368d81876d03f337e4ec3994515a1e9b8c9d4a5f1ebe118
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains numerous external URIs, many of which point to disposable domains and are likely part of a link farm. The ML classifier and ClamAV both flagged this PDF as malicious, specifically as a phishing or trojan variant. The presence of embedded URLs and the heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggest a phishing attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=professional+c+v+format+in+word PDF link annotation
    • https://cdn.sqhk.co/dudugetogi/heGUiiF/89868928138.pdfIn PDF document text
    • http://natnat.fun/92961356493g8ic1.pdfIn PDF document text
    • https://cdn.sqhk.co/jebumujo/jejjvBJ/krabathor_orthodox_cd.pdfIn PDF document text
    • http://50offit.pro/how_do_you_calculate_the_average_timee2v4v.pdfIn PDF document text
    • https://cdn.sqhk.co/lokiwejawe/jhyy7zP/42702468865.pdfIn PDF document text
    • http://kersita.fun/dallas_willard_renovation_of_the_heart_summaryjgz1y.pdfIn PDF document text
    • http://thrivewebs.com/95189912761ie1xz.pdfIn PDF document text
    • http://pumba-timon.space/keponutezivoteviguguwu8m85.pdfIn PDF document text
    • http://help-bluebadgecustomer.com/skyworth_smart_tv_50_inches_pricetkn0r.pdfIn PDF document text
    • http://santand-es.com/43711383978dv5dj.pdfIn PDF document text
    • https://vadururufuwowo.weebly.com/uploads/1/3/4/5/134581676/fonen_vamasiretiwivif.pdfIn PDF document text
    • https://cdn.sqhk.co/xonarewu/iahejdd/vomagugogekupitof.pdfIn PDF document text
    • https://rofikilidoxomuk.weebly.com/uploads/1/3/4/0/134017179/5811110.pdfIn PDF document text
    • http://pixell.store/weber_electric_bbq_home_depot3ss0v.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbd1811b-d681-43c0-b26f-3e466d08ae91/luxpro_thermostat_manual_tx9000ts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c54ea929-47a5-4ee6-a1f4-5713f03642a2/55200897479.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51b6eddb-c9c2-48b8-957a-1b36b255e206/15336877481.pdfIn PDF document text
    • http://teruwizirazi.rf.gd/bhagavad_gita_english_download.pdfIn PDF document text
    • http://rajafidaforuzav.epizy.com/free_antivirus_software_for_acer_laptop.pdfIn PDF document text
    • http://zusunikumejimet.rf.gd/traffic_report_10_freeway_los_angeles.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d686355f-9a25-453d-a062-f3e5b46a4308/lexolozibudabas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88c9481f-fd4d-4422-beb1-7de0c9b7da48/pride_and_prejudice_2005_movie_with_english_subtitles_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000138bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138BF 5320 bytes
SHA-256: 205d656c07858d003f86ff9d750a3c4a21371c7b5827c51439399495b07d3be2
font_01_sfnt_off00014ad5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14AD5 10756 bytes
SHA-256: d7fa82c672b6108bcc38924fc4e057f5ba5636ba86ba3a82b4ceb638d6e497be

Open this report in the interactive analyzer, or submit your own file for analysis.