Malicious PDF — malware analysis report

Static analysis result for SHA-256 109a683fd336d43e…

MALICIOUS

PDF

71.9 KB Created: 2021-03-18 01:59:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 730fbb887613e1bdd26d8fde376d32ed SHA-1: 79922e6f9a4327c52804442da6b7932b250f1181 SHA-256: 109a683fd336d43e08133f37866484082f45c75073bac2b047497fe85e5edf9d
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to disposable domains or link farms, suggesting a phishing or redirection attempt. The document body, though heavily obfuscated, contains metadata related to its creation, but no direct instructions or lures are discernible.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=build+an+atom+phet+lab+solutions PDF link annotation
    • http://wirobigi.medianewsonline.com/bearing_selection_handbook.pdfIn PDF document text
    • https://dumunevebule.weebly.com/uploads/1/3/0/8/130874169/zomugo.pdfIn PDF document text
    • https://wivepeweg.weebly.com/uploads/1/3/1/4/131455463/9277097.pdfIn PDF document text
    • http://loneresel.mygamesonline.org/jaxusejiwagum.pdfIn PDF document text
    • http://vogolimipogusoz.mypressonline.com/64327294279.pdfIn PDF document text
    • http://wozilimesiz.mypressonline.com/ansiedad_social_2020.pdfIn PDF document text
    • http://trackcreditscore.info/morako83bqx.pdfIn PDF document text
    • https://ruxuxosiforedop.weebly.com/uploads/1/3/4/4/134491380/muzawiwesovu.pdfIn PDF document text
    • https://xevogivuzu.weebly.com/uploads/1/3/5/3/135350373/16a2cc7a.pdfIn PDF document text
    • http://moscowflowers.online/how_to_reflect_the_suns_heat_reach_earthfv5y9.pdfIn PDF document text
    • https://loloxemevo.weebly.com/uploads/1/3/0/7/130739498/govitegujav-pamujutexinup-nerupalukoba.pdfIn PDF document text
    • http://tameenegypt.com/cnc_machine_cost_price7svmv.pdfIn PDF document text
    • http://najetaxu.mygamesonline.org/skull_adirondack_chair_plans.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cadc798-7219-401c-afc5-e839a5963345/what_is_the_role_of_media_in_international_politics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/091ac0ef-b126-45da-b426-1052c938d8d3/lizasip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a98cdded-988f-459a-918e-1a46ffdf055a/xenumosilinu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ddc2db6-909a-4a3b-ab9f-bf69fd96759e/tebonasepalitopatawugi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44848a7a-b36f-4ab0-a30b-7a0c98dd8324/tanenataxulukivedefuzol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/873b5437-a391-47ab-a4f9-302f76203093/66534608392.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA16 5292 bytes
SHA-256: 6354203868e7177c72f32f72cdc8ba696582db02d9f38f9655967d769d407c81
font_01_sfnt_off0000ebe9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBE9 11956 bytes
SHA-256: dc95148726b4c2a48b202341e36164fa29b61c59519872f0c1055b881108dc32

Open this report in the interactive analyzer, or submit your own file for analysis.