Malicious PDF — malware analysis report

Static analysis result for SHA-256 0cc72871f59a5c0c…

MALICIOUS

PDF

81.8 KB Created: 2021-04-09 21:57:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 169e22b43b240d05b188fbcdd86ea822 SHA-1: 7c1922115bc1a828a341e1d4c22b3191ba7fc2d1 SHA-256: 0cc72871f59a5c0c0e4615dcafe90d9a6281a9fd7b7e956351aaee4a39d1074b
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for Pdf.Phishing.Trojan and an ML classifier indicating maliciousness. The document contains numerous external URIs, with one prominent URL pointing to a suspicious domain that appears to be part of a link farm. Although no scripts were explicitly extracted, the PDF structure and the nature of the URLs suggest an attempt to redirect the user to a malicious site, likely for phishing or to download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=is+the+hp+pavilion+x360+good PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4450733/normal_6064bc6230ffc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367923/normal_604eb0826c647.pdfIn PDF document text
    • http://banuduxirodeb.mypressonline.com/alimentos_ricos_en_hierro_para_nios.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501962/normal_605a67c8d794a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369512/normal_5fedfed3cc855.pdfIn PDF document text
    • http://bawazofo.getenjoyment.net/rt-ac68u_asus_review.pdfIn PDF document text
    • http://sawemawe.mywebcommunity.org/drinking_a_love_story_audiobook.pdfIn PDF document text
    • http://fesotisifofil.mygamesonline.org/pdf_split_and_merge_basic_download_free.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368469/normal_603d1997babd3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382638/normal_60334c84831ff.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/51aa3c09-b055-4cb2-bedb-d3d5f9e5e6c2/9832543296.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e8557f8-1fba-41fa-8e8a-bf0dcd3cc61c/1162995685.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a31f7ef-2205-4c83-9377-eb64f67ec682/romance_of_the_three_kingdoms_xiv.pdfIn PDF document text
    • http://getorimojaz.rf.gd/balance_ton_quoi_partition_piano.pdfIn PDF document text
    • http://fovodikil.rf.gd/37685425531.pdfIn PDF document text
    • http://faminosokaru.epizy.com/57979665630.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78065ed7-cb72-4aa6-90fc-5e4bd00efd15/84978462933.pdfIn PDF document text
    • http://fisuzes.epizy.com/box_39a_on_your_form_1040.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82b3cc42-e482-4b9f-b64a-3ab89ed12dbe/my_canon_mx922_is_not_printing_black.pdfIn PDF document text
    • http://lofomaseforuz.rf.gd/6th_grade_reading_comprehension_test_nc.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1cc5f47-38f2-45c7-89f8-d182c21179b0/major_events_in_us_history_after_ww2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28f23a13-c612-496c-bfbb-444d316ddb54/32808340188.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001027b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1027B 5652 bytes
SHA-256: d655c5ea91db02c8b880dc3f291043ca710ce1ff029031c6a0d32f09caaeb8b7
font_01_sfnt_off000115bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115BB 10588 bytes
SHA-256: 9d447c5cab92a4934ba7219c43b3957c039b7c41b15737a3241d201e36aff91d

Open this report in the interactive analyzer, or submit your own file for analysis.