Malicious PDF — malware analysis report

Static analysis result for SHA-256 085df946c7820da7…

MALICIOUS

PDF

89.5 KB Created: 2021-06-06 12:27:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 83d6d182073196f45be0ef32c6d41768 SHA-1: df20ae908dd78f9fd2e4b866a07ca30c26b1cbd5 SHA-256: 085df946c7820da76b06d377f295870ae00703e227cbd6eeeb67076e89f2a009
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with a specific heuristic identifying it as a link farm on disposable hosting, pointing to https://nipisod.ru/123?utm_term=day+month+year+date+format+in+java and https://nugasoxitobaj.weebly.com/uploads/1/3/2/7/132710773/fikafeguk_judenutenizu.pdf. The document body, though heavily obfuscated, contains references to 'day month year date format in java' and wkhtmltopdf, suggesting a potential lure or exploit context.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=day+month+year+date+format+in+java
    • https://nugasoxitobaj.weebly.com/uploads/1/3/2/7/132710773/fikafeguk_judenutenizu.pdf
    • https://puvedevedumu.weebly.com/uploads/1/3/1/4/131406841/5455724.pdf
    • https://jowetirepenu.weebly.com/uploads/1/3/1/3/131383619/979456.pdf
    • https://cdn-cms.f-static.net/uploads/4402949/normal_6061caabcdad2.pdf
    • https://kelezisexuva.weebly.com/uploads/1/3/0/7/130739204/tasibe.pdf
    • https://merudaxesu.weebly.com/uploads/1/3/1/3/131383629/waxoju_wojujivumav.pdf
    • https://cdn-cms.f-static.net/uploads/4481522/normal_604b5c9eeab97.pdf
    • https://rasuzumiketasak.weebly.com/uploads/1/3/4/3/134393825/wizedok-bujopipefil-sifisikowaxeve.pdf
    • https://kebotufu.weebly.com/uploads/1/3/4/7/134735966/xaxavapokexinox-suxan-xiteroboza-tudasuwonol.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/623fb57a-a360-4b98-852f-2eb62180c731/lelekabaje.pdf
    • http://zexowisam.pbworks.com/w/file/fetch/144427884/el_manual_de_los_jovenes_castores.pdf
    • https://uploads.strikinglycdn.com/files/5076e3a0-c969-45d2-ae38-d5725cd52920/how_to_get_unlimited_uc_in_pubg_mobile_lite.pdf
    • https://uploads.strikinglycdn.com/files/0ae62afb-d4fa-45f0-a8f4-4878c1e4f967/dirt_devil_ultra_hand_vac_manual.pdf
    • https://uploads.strikinglycdn.com/files/3f6c43b6-4b45-48a4-a005-53f0aa253f4f/organic_chemistry_meaning_examples.pdf
    • https://uploads.strikinglycdn.com/files/e561a80e-a818-4af2-a571-bc7a69a34825/congruence_and_similarity_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/9cd123a4-dc27-4b4a-8e06-e841cfd978a0/50661455028.pdf
    • http://mosijiv.pbworks.com/w/file/fetch/144716208/83236090704.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb46.bin
c6acebe3750ab55c09714fa1b34f6c70ddae3ce202e1a088ffcbc34adab53285		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB46 6588 bytes
font_01_sfnt_off0000fbc0.bin
4870b11507f7c2d439d8178f2e72186f6384cc6f6612c497985fb569a9de4985		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBC0 5172 bytes
font_02_sfnt_off00010d43.bin
4bf5be023488f6aa6279bebfad88d02ff945f583ad38504fc639def3f12bdf66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D43 2924 bytes
font_03_sfnt_off00011997.bin
be723f8de582473e4c0189b403f159afc69bc7258373b4e25ae3dada483c10e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11997 11212 bytes
font_04_sfnt_off00013feb.bin
1b19f5b9ae2aeff7929e120295d9aee049321614abc14b3ca723126b23f9dd5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13FEB 16416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.