Malicious PDF — malware analysis report

Static analysis result for SHA-256 0be47a1502019727…

MALICIOUS

PDF

113.7 KB Created: 2021-04-07 04:12:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: b10ce0d89cf9b4448bd859816caae597 SHA-1: 2000a10045cb56b2b234e9b73148dd654478935f SHA-256: 0be47a1502019727071339526acbfbfee3a6419f63cd9ece1ef8af6053377795
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many of which point to disposable hosting and are flagged as part of a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as phishing or trojan activity. The document body, though heavily obfuscated, suggests a lure related to educational materials, likely to trick users into visiting the malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=manual+de+aprendizajes+clave+primaria+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4446377/normal_5fe82c617e251.pdfIn PDF document text
    • http://eeeeeyyy.space/257990374125pc5e.pdfIn PDF document text
    • http://madawuboso.sportsontheweb.net/cerny_coptic_etymological_dictionary.pdfIn PDF document text
    • http://ruxuzosok.mywebcommunity.org/vomipuzepuzufu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422894/normal_605f2a67aa82f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4527902/normal_606cffcb6bb51.pdfIn PDF document text
    • http://mudixefibewab.mywebcommunity.org/teori_hirarki_kebutuhan_abraham_maslow.pdfIn PDF document text
    • http://sazulido.medianewsonline.com/arduino_sensor_shield_v5_0_bluetooth.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494139/normal_5fda8f3c1faac.pdfIn PDF document text
    • http://bigmagazin.xyz/36322879824gr3xu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445331/normal_601c85b22ee2c.pdfIn PDF document text
    • http://businessoutsourcing.org/wefuwogisamzuxzv.pdfIn PDF document text
    • http://lerob.info/hack_para_archero_android7shef.pdfIn PDF document text
    • http://wopizup.mypressonline.com/brihaspativar_vrat_katha.pdfIn PDF document text
    • http://goproits.com/the_taming_of_the_shrew_character_mapekr9l.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://wufagezigedo.onlinewebshop.net/5629553612.pdfIn PDF document text
    • https://11f44e1d-c86f-4be6-baa1-90970e7c24f5.filesusr.com/ugd/a298ce_8996a4d46d4c43ca9e5fdf884d1123d2.pdf?index=trueIn PDF document text
    • http://durenifujogax.myartsonline.com/feluvadikiba.pdfIn PDF document text
    • https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_8c256ac982cc439e94718e02cc3bcfdc.pdf?index=trueIn PDF document text
    • https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_ceb4d906a79f4f77ae47fe7ff5107b6f.pdf?index=trueIn PDF document text
    • http://xenezipulugiji.atwebpages.com/types_of_artificial_intelligence.pdfIn PDF document text
    • https://42cc6f6d-9125-48bc-bce4-1bf15f49b1be.filesusr.com/ugd/7c30af_318b2d28586e43de9e7f118c3dafef0f.pdf?index=trueIn PDF document text
    • https://eed7fa7e-4f31-4ba6-8269-e73f07ac74c5.filesusr.com/ugd/93374d_6ca0e522fc8147948bb024d56c8b0782.pdf?index=trueIn PDF document text
    • http://zigemevopowab.epizy.com/bullying_escolar_en_chile.pdfIn PDF document text
    • http://rabatelekovufar.myartsonline.com/muzidowemikujediv.pdfIn PDF document text
    • http://tiredosutozol.atwebpages.com/80811765585.pdfIn PDF document text
    • http://tugojan.rf.gd/starcraft_ii_field_manual.pdfIn PDF document text
    • http://zemufupifa.epizy.com/what_is_nikes_core_marketing_strategy.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000159c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x159C6 5184 bytes
SHA-256: 9b1f8124e82a8fc26ad401b8f173f8492e65fa012c20fe54081fa10011e1d3ba
font_01_sfnt_off00016b5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16B5B 12364 bytes
SHA-256: 5a4b1dfc4255bffe48c33118116548ec76279d4df513d58ab750c0f3fe5e3857
font_02_sfnt_off00019355.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19355 16140 bytes
SHA-256: 159427b32ed66bfbde86def5e6c2992bde67dfb25400c4000a37c9b59b949b61
font_03_sfnt_off0001a851.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A851 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.