Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f476b66f3bad82a…

MALICIOUS

PDF

70.0 KB Created: 2021-03-10 03:31:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: dfea7fb50913166caff4fe34b95ede05 SHA-1: 539b4332edb02933a45adbc5b1056e4a4e0d18fb SHA-256: 0f476b66f3bad82a28691aadd4829a87f19078142fc0a0f32f90c36835815538
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous external URIs and is identified as a link farm hosted on disposable domains, indicating a phishing or scam attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect users to malicious websites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=casio+watches+f+91w+manual+pdf PDF link annotation
    • https://sobexezawatu.weebly.com/uploads/1/3/4/9/134903145/62c372a8876.pdfIn PDF document text
    • https://zoninezazazi.weebly.com/uploads/1/3/1/0/131070362/8328891.pdfIn PDF document text
    • http://wewofif.scienceontheweb.net/inkscape_trace_bitmap_not_opening.pdfIn PDF document text
    • http://vosajizegek.mypressonline.com/what_determines_standard_enthalpy_change_of_formation.pdfIn PDF document text
    • http://mamefumiwuto.mywebcommunity.org/80523000459.pdfIn PDF document text
    • http://vumajuzatijerak.getenjoyment.net/dekixujugerudujide.pdfIn PDF document text
    • http://mutinujevax.22web.org/sample_blood_test_report_for_dengue.pdfIn PDF document text
    • http://worameruvejaka.mywebcommunity.org/c_programming_language_tutorial_for_beginners_in_telugu.pdfIn PDF document text
    • http://dapurixid.sportsontheweb.net/couper_document_en_deux.pdfIn PDF document text
    • https://zodutobaziji.weebly.com/uploads/1/3/1/4/131408241/2836810.pdfIn PDF document text
    • http://nubatevujonuw.mygamesonline.org/what_hand_makes_29_in_cribbage.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zilowovuv.atwebpages.com/zirolinugaji.pdfIn PDF document text
    • https://s3.amazonaws.com/dukajevo/free_html_ecommerce_templates_bootstrap.pdfIn PDF document text
    • https://s3.amazonaws.com/tisegovofu/what_are_the_primary_benefits_from_investing_in_income_property.pdfIn PDF document text
    • http://tapopopabe.rf.gd/workbook_and_worksheet_object_in_excel_vba.pdfIn PDF document text
    • https://s3.amazonaws.com/tisegovofu/the_little_brown_handbook_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/sesafefanulokam/xofilivomuwapasowobixe.pdfIn PDF document text
    • http://vuzuwukef.atwebpages.com/code_name_verity_julie_quotes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d366.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD366 5504 bytes
SHA-256: b6efbed9fcffb27a444916623a6f4110e13579a4c6e91a73008e6a72dc98432a
font_01_sfnt_off0000e610.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE610 10224 bytes
SHA-256: 25f2747659323cfc33814d8e4e5da3382cb9bb628eba4601aabf5ce5e819bfad

Open this report in the interactive analyzer, or submit your own file for analysis.