Malicious PDF — malware analysis report

Static analysis result for SHA-256 0cf37adeee205136…

MALICIOUS

PDF

77.0 KB Created: 2021-03-30 17:03:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc550cf4292603fb53fcfabb75ab0d40 SHA-1: 7343ddbc7465efb520862ae6c572fb85a9551d9b SHA-256: 0cf37adeee2051362bfefd45d7766833bb84c78a4f6ad05b67d5cf18bbfd6dbe
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with a notable heuristic identifying it as a link farm on disposable hosting, suggesting a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains references to 'Bootstrap form maker online', aligning with the lure of a utility to attract clicks to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=bootstrap+form+maker+online
    • http://medgaj.com/migatak4z2x1.pdf
    • http://big-ita.space/dazok1iyns.pdf
    • https://cdn.sqhk.co/lenubire/78vhc6m/homeschooling_washington_state.pdf
    • https://cdn-cms.f-static.net/uploads/4414336/normal_6026c1aa31bca.pdf
    • http://ijmalan.xyz/jipunuvurejujawavusufec2mf.pdf
    • http://good-production20.site/78711645186y2slr.pdf
    • https://cdn.sqhk.co/sukurorezib/PhiKtQh/offline_gps_maps_windows_7.pdf
    • https://cdn.sqhk.co/bovokolel/1nghDIe/tippy-_tip_corner_meaning.pdf
    • https://cdn.sqhk.co/letareximo/gcshbIJ/10079392841.pdf
    • http://italia-doc.space/628290278481ls35.pdf
    • http://bitcoins-profits.com/kenmore_elite_he3_washer_replacement_parts6du6g.pdf
    • http://dmgameplan.com/rita_mulcahy_pmp_exam_prep_10th_editionkw8sf.pdf
    • https://cdn-cms.f-static.net/uploads/4449781/normal_605ac86a17ec9.pdf
    • http://mir23.xyz/tissot_watches_t_touch_set_timeudxfa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_637693942e6a4dfabf5355065e98a1cf.pdf?index=true
    • https://uploads.strikinglycdn.com/files/58632182-a5e0-482e-998a-830d336da705/username_privilege_secret_cisco.pdf
    • https://141ebdc9-a3c9-4c6d-b8f9-366dbf139dec.filesusr.com/ugd/46bfb0_333c4fdfd449477b828128cd92d0a5d7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b13bf003-0d5e-4146-89b6-a5e5798da744/html_css_interview_questions_and_answers_for_freshers.pdf
    • https://86860ce8-2957-478e-97c3-2abddc2d2c3c.filesusr.com/ugd/754ed1_1a21b21f148944ecac0305b5fea8d50f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5364a1fc-d8f4-4daf-bf63-4d896d6ca379/tadesajimasovobizida.pdf
    • https://849bdae7-2456-4570-9e2a-fc769e7e49ad.filesusr.com/ugd/2074c9_acdbaf08ec924a9282b4a186a7588565.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef77.bin
b233179355aba76d86b09632cbd16af71fc70586c3da540751da7d5378433353
pdf-font-stream PDF embedded font (sfnt) at offset 0xEF77 5160 bytes
font_01_sfnt_off000100f4.bin
059e1b26e696b5c674e5ed86d00bb71aeff025cae7c033ef980c5d6f04d8aee9
pdf-font-stream PDF embedded font (sfnt) at offset 0x100F4 10712 bytes