Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a64239742ed42dd…

MALICIOUS

PDF

79.3 KB Created: 2021-04-27 09:04:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-03
MD5: 3733c905758b368f46560865ad408e84 SHA-1: 90419b05d319dc328a496c37c55b97c1672c6ee0 SHA-256: 0a64239742ed42ddc5cf3c5d9dac54270c0a2f29c5bbdb51cafbd85ac478264c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with a primary one pointing to a suspicious domain associated with a software download lure ('fl studio 12 200mb'). The heuristic PDF_SEO_DISPOSABLE_LINK_FARM indicates a large number of links on disposable hosting, suggesting a phishing or malware distribution campaign. ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=fl+studio+12+200mb PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4384318/normal_603cb332c210a.pdfIn PDF document text
    • http://hookup157.online/turexademokinomokonorjpgny.pdfIn PDF document text
    • http://d2-club.ru/job_advertisement_and_application_form27zem.pdfIn PDF document text
    • https://muwegegedagus.weebly.com/uploads/1/3/0/7/130738526/ponigajutipom-tenirexajeso.pdfIn PDF document text
    • http://samoe-samaya.ru/96476337092x9aws.pdfIn PDF document text
    • http://carbackseat.site/pimutotiragagoweka552.pdfIn PDF document text
    • http://itchia.space/90771007957mpiiu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421983/normal_5fd3b9c851f44.pdfIn PDF document text
    • http://astrology-personal.online/vididolatetokodumigafipasmqesj.pdfIn PDF document text
    • http://kigumelez.medianewsonline.com/84688213368.pdfIn PDF document text
    • https://xadifera.weebly.com/uploads/1/3/1/4/131438156/1988656.pdfIn PDF document text
    • http://lerimofo.mywebcommunity.org/8480089951.pdfIn PDF document text
    • http://vozobatenaw.mywebcommunity.org/46776987258.pdfIn PDF document text
    • http://nunobuzipame.medianewsonline.com/neural_networks_and_deep_learning_basics.pdfIn PDF document text
    • http://pinerapidsrr.com/936862950188oqbs.pdfIn PDF document text
    • https://zixulelivu.weebly.com/uploads/1/3/4/5/134507035/debasasevi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467955/normal_603500bfd8d99.pdfIn PDF document text
    • http://nijewogifuzazi.mypressonline.com/introduction_to_statistical_quality_control_7th_edition_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://247e77cc-5367-4382-8586-7c5891409f42.filesusr.com/ugd/2dbf5a_c007f98e7eeb4eb7bde41aa1ba83856d.pdf?index=trueIn PDF document text
    • https://f64a1a0a-debf-4843-a838-a34c0cae0f4a.filesusr.com/ugd/89602e_cc4a5ba41a774a4b85b53bb9f4b96e22.pdf?index=trueIn PDF document text
    • https://e8f98835-b194-42a5-b43f-fe2f29920dd6.filesusr.com/ugd/bf650e_9b2d320f0b2f41cba11403c4308d1f94.pdf?index=trueIn PDF document text
    • https://edb7bb8d-792a-4213-93ec-7f573d37cc74.filesusr.com/ugd/bfd504_e82081ea99aa42c395cd9f2d2b5c476c.pdf?index=trueIn PDF document text
    • https://16dc6c2a-32e3-4a69-9eea-5b59d93654f8.filesusr.com/ugd/176c29_c6854d5505074f63a79145c6ea499555.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f64b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF64B 5088 bytes
SHA-256: 4e3e403ab793bfe7ea0bfd95ab73e900f410cbe713bfdce199b3ecd1c8dba956
font_01_sfnt_off0001078d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1078D 12492 bytes
SHA-256: 68ebaf64316c037cded2e54dc6e7819ff3c49464cb465717079603fec24f7bbb

Open this report in the interactive analyzer, or submit your own file for analysis.