Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f78036b5b0667ec…

MALICIOUS

PDF

77.0 KB Created: 2021-03-02 15:43:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 295371b58d83505a96ca55820eb90743 SHA-1: 4671a6806ba2bd50a12864a7812f209f05012f32 SHA-256: 0f78036b5b0667ecc14c28e619dd7a1c54721ac3df8f473417419890245fc6f3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains multiple embedded URLs, many of which point to disposable hosting and are part of a link farm, indicating a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect users to phishing sites or download further malware. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a malicious document, likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=how+do+i+get+my+hp+officejet+4500+wireless+to+scan PDF link annotation
    • http://getbuiss.online/badger_5_numbers_for_january_1st_2021moxsk.pdfIn PDF document text
    • https://wowutelugige.weebly.com/uploads/1/3/4/3/134359508/9c075b2.pdfIn PDF document text
    • http://options.expert/what_are_the_key_principles_of_family_systems_theoryajgts.pdfIn PDF document text
    • https://timitadenemegi.weebly.com/uploads/1/3/4/7/134728598/8057714.pdfIn PDF document text
    • https://cdn.sqhk.co/nizivatitogu/acRgj08/pojugizarinibuvuwepaloj.pdfIn PDF document text
    • http://luminar3-download.xyz/the_madwoman_in_the_attic_downloadc92if.pdfIn PDF document text
    • http://kismyketio.com/pelicula_mas_alla_de_los_sueC3B1os_completa_en_espaC3B1olgjx3q.pdfIn PDF document text
    • https://vudemigubujesi.weebly.com/uploads/1/3/5/3/135300151/putidipaxuvisevubi.pdfIn PDF document text
    • http://baramijotafexo.mypressonline.com/lejimoninalozaxesenutiw.pdfIn PDF document text
    • https://cdn.sqhk.co/ximirujusuxo/hhicghT/pesatesez.pdfIn PDF document text
    • https://cdn.sqhk.co/vovawumusa/ifSgigg/warzone_bunker_codes_season_5_prison.pdfIn PDF document text
    • https://cdn.sqhk.co/xamitarerivu/bChbjai/74691926178.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://gurabagoderes.atwebpages.com/dujewotedobajesivagizore.pdfIn PDF document text
    • http://bivojeda.atwebpages.com/xbox_360_codigo_de_error_03-80-00.pdfIn PDF document text
    • http://xakagigoneliv.myartsonline.com/the_cat_in_the_hat_knows_a_lot_about_that_episodes_wiki.pdfIn PDF document text
    • http://vidugozu.atwebpages.com/63107270396.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e028.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE028 2868 bytes
SHA-256: e7aa2388688bed85150dd2f29d3a27ce720a633cd264ff1d0661bee30101debc
font_01_sfnt_off0000ea5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA5C 6152 bytes
SHA-256: ef083f4e87c273b2c4ae62a6cf8a6f5fd968c4e543cc78e7281a7adfac718755
font_02_sfnt_off0000ff4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF4E 11496 bytes
SHA-256: b4b97093e20e61eb5c2a753d1461e181ad20dbcce234f6305c4652aba1228ce0

Open this report in the interactive analyzer, or submit your own file for analysis.