Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b55a35eac089bfc…

MALICIOUS

PDF

84.0 KB Created: 2021-04-27 06:48:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 77960e90d72e98ac9cde80087a4b3273 SHA-1: 48ea990cbcb8b1513a7ed41d8fceea1a79dec03c SHA-256: 0b55a35eac089bfc773aa816b4db7236eff3ed645a22f7ea707d86fb1855a688
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many pointing to disposable domains, and is flagged by ML classifiers and ClamAV as malicious phishing content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a deliberate attempt to create a link farm for SEO manipulation, likely to host phishing pages or malware. The presence of external URIs suggests the document is designed to redirect the user to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=fisher-price+cradle+%2527n+swing+manual PDF link annotation
    • https://cdn.sqhk.co/tavanaru/MhjzDhj/pinojakigimup.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369626/normal_602b5077819fa.pdfIn PDF document text
    • http://jexekiraj.sportsontheweb.net/gefupoxinurikobabug.pdfIn PDF document text
    • http://springital.fun/1698767527ueexi.pdfIn PDF document text
    • http://solavopuna.22web.org/critical_thinking_defined_nursing.pdfIn PDF document text
    • http://centerbluebadge.com/26213595383z83o.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417305/normal_601d2bcdb9667.pdfIn PDF document text
    • http://santand-es.com/turtle_beach_x42_setup0nhga.pdfIn PDF document text
    • https://cdn.sqhk.co/fazituku/e9yXIgi/air_combat_racing_download.pdfIn PDF document text
    • https://cdn.sqhk.co/kodivitedi/ggg5gfe/raxovezatasexoxuvewol.pdfIn PDF document text
    • http://vurovolapoza.mygamesonline.org/ninisusiduzaxerusawubem.pdfIn PDF document text
    • http://mavixepajifulem.scienceontheweb.net/technical_drawing_standards_iso.pdfIn PDF document text
    • http://dk-inc.xyz/majanisizenebipuwulurepi9ir1y.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://rupesujutiwu.myartsonline.com/how_to_reach_walmart_by_phone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11539428-d223-4d93-9972-901d1bb64daf/gafinadikoloje.pdfIn PDF document text
    • http://xijovapafibowuw.rf.gd/lagu_cinta_luar_biasa_reggae_munir.pdfIn PDF document text
    • http://nibopinalilabaj.onlinewebshop.net/programacin_neurolingstica_definicion.pdfIn PDF document text
    • http://fatapiwav.rf.gd/wavujexusoloramoli.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee3b2f2e-3a60-4b4a-8d39-9fd77cfaaf41/trane_xe_1200.pdfIn PDF document text
    • http://matezule.rf.gd/pollybeak_deformity_after_rhinoplasty.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1EB 5684 bytes
SHA-256: caeed39893b82969c26dfcac95946a3fad4fbae0765b3ea81aa15456cfe783a6
font_01_sfnt_off0000f5c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5C6 5600 bytes
SHA-256: ebfe31e257f23ac28bb48290a61114b4a48f4f2c430a36b9ef628cd999326184
font_02_sfnt_off000108bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x108BD 6640 bytes
SHA-256: c8cb303e765c67f43d6d34f29c1d02953890772ff7b697be779fb29335000f72
font_03_sfnt_off00011a5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A5C 11672 bytes
SHA-256: c551a0017a1653e7710adac98ff5fde587aa825a8d60dcbdacecc5d0fab5dad5

Open this report in the interactive analyzer, or submit your own file for analysis.