Malicious PDF — malware analysis report

Static analysis result for SHA-256 11ea5d91fb8429ea…

MALICIOUS

PDF

78.6 KB Created: 2021-03-17 00:00:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 7852679cef4e8144f2e69f3c625923cf SHA-1: 7db074c3c845f26b608530ff17cabc27344fce0c SHA-256: 11ea5d91fb8429eabaf634fdbe6bb810755ac135dbc02014ab64735ddc950d3b
226 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV. It contains a large number of external links, many pointing to disposable domains, suggesting a link farm or redirection scheme. The presence of a 'Password-protected archive handoff' heuristic indicates it may be used to conceal a malicious payload, requiring the user to download an additional file. The document body, though heavily corrupted, contains references to 'Chrono trigger ds guide pdf' and 'wkhtmltopdf', suggesting a lure document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=chrono+trigger+ds+guide+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4497685/normal_6036c36312e97.pdfIn PDF document text
    • http://xigukogotawat.iblogger.org/2013_dodge_charger_rt_daytona_edition_for_sale.pdfIn PDF document text
    • https://zitolibozix.weebly.com/uploads/1/3/4/0/134040523/d0178.pdfIn PDF document text
    • http://detonic-official.website/the_holy_quran_in_english_app7b7ju.pdfIn PDF document text
    • http://flylovel.com/fotogokode545yr.pdfIn PDF document text
    • http://rameautbxy.space/how_to_calibrate_magic_chef_gas_ovenjgu6k.pdfIn PDF document text
    • http://nukuxarigikuxez.iblogger.org/47590116329.pdfIn PDF document text
    • http://springital.fun/open_password_protectedarv5r.pdfIn PDF document text
    • https://moxamegok.weebly.com/uploads/1/3/3/9/133999551/17b21b7e990f896.pdfIn PDF document text
    • http://everydayy.fun/113727059742h8n7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409992/normal_6024cd02c9f58.pdfIn PDF document text
    • https://pawuxadatunu.weebly.com/uploads/1/3/4/2/134266652/2461597.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386361/normal_5feef946b830d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457318/normal_601dcf029a4f9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/4d5b7940-f3de-45f0-8705-4c43761232c3/73535413647.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1749f1b5-48fa-4c14-b712-91101044d008/kenmore_80_series_washer_timer_knob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8145b50-68f1-4450-8800-e9eb6d54a2b8/how_to_find_the_area_of_a_scalene_triangle_with_coordinates.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2338bb94-5c98-4f62-92de-0724f92904ea/where_is_bluetooth_on_samsung_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55be7e13-2deb-45f9-9de8-bb2e20d64d60/zipufamipiratagopusa.pdfIn PDF document text
    • http://fiwixowu.rf.gd/professional_email_etiquette.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f782337-bc26-4356-82f5-7c7b12f7c08d/how_many_volumes_does_saga_have.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cef9d9cf-27b3-43f0-b2cf-5f4cd9f533d5/nigigemumategapeweraxol.pdfIn PDF document text
    • http://pulavoxojefu.rf.gd/nelitewejisafarijexomele.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA42 4968 bytes
SHA-256: 5cb8d4e4066b8e8ac0342f220f33b26cc5bbbfe2e02dc2e477455ae45a3bb984
font_01_sfnt_off0000fb26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB26 10276 bytes
SHA-256: 009e1bcc92ab2408d50af9d11c23442ea24cd97fed1ce5a67a955a836340c49b
font_02_sfnt_off00011e60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E60 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.