Malicious PDF — malware analysis report

Static analysis result for SHA-256 1589bcf0e43324b7…

MALICIOUS

PDF

129.4 KB Created: 2021-02-17 15:26:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 1493bbcc6b88c9cc1326eab83afcbc57 SHA-1: 0346c8cc353ccd10f43e09573e2e742c20c9bf15 SHA-256: 1589bcf0e43324b726ad3457797d49b1cacb76621e7fe1f2e5c9be8dfb3483de
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with a high concentration on disposable hosting and redirectors, indicative of a link farm designed to obscure the final malicious destination. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggests this malicious intent. While no scripts were explicitly extracted, the presence of external URIs and the ML classifier's high confidence score point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=opnavinst+5530+14e PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4455174/normal_5fce94015db41.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392452/normal_5fe2f2b1e1794.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387241/normal_60067f3f19ada.pdfIn PDF document text
    • http://detonic-italia.website/zelawa55sg.pdfIn PDF document text
    • http://zinuvudoliku.iblogger.org/zekosezupisunovapolijul.pdfIn PDF document text
    • https://gosawopidelogeb.weebly.com/uploads/1/3/4/7/134714887/bumaxasasin.pdfIn PDF document text
    • https://pabovojusu.weebly.com/uploads/1/3/4/3/134339388/mumakazivabuk.pdfIn PDF document text
    • https://fuxiwajusefu.weebly.com/uploads/1/3/4/6/134617271/3d2bc235634358.pdfIn PDF document text
    • http://sexugaweguko.iblogger.org/vazafosuwebadijawiwab.pdfIn PDF document text
    • https://manovofaripoluf.weebly.com/uploads/1/3/1/4/131453531/tosamilivo.pdfIn PDF document text
    • https://lexabebuwapo.weebly.com/uploads/1/3/1/3/131383838/3516779.pdfIn PDF document text
    • http://makamar.xyz/disney_cruise_jobs_salaryxwkr9.pdfIn PDF document text
    • https://nezivubu.weebly.com/uploads/1/3/1/3/131384481/5778003.pdfIn PDF document text
    • http://womenita.fun/41337812992rzg91.pdfIn PDF document text
    • http://6gusevshop.website/jixolenubudutalavoduge3i7fz.pdfIn PDF document text
    • https://molesomux.weebly.com/uploads/1/3/2/6/132681378/fa1cd8a6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://vagafalim.rf.gd/fopawurowuvifo.pdfIn PDF document text
    • http://rujekikixew.epizy.com/poduzolikudabilagex.pdfIn PDF document text
    • http://ninoxubus.rf.gd/dvt_ultrasound_nice_guidelines.pdfIn PDF document text
    • http://winovonisalupib.rf.gd/39772339381.pdfIn PDF document text
    • http://fobuzepiru.epizy.com/chevrolet_aveo_2013_ls_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019c15.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19C15 9276 bytes
SHA-256: a0f9adb6935df78f3aaa09cd14b63e1120167c51e09c805aca8fd24e44b43b39
font_01_sfnt_off0001bb2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BB2E 5340 bytes
SHA-256: 2521028795183ecc434ec71a4023122230fdd4b4c3ad547549b1f341df00b9a6
font_02_sfnt_off0001cd7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CD7E 12268 bytes
SHA-256: fa54d9aec21b06edf8f4b43db6f689c58494e6f0bb222015379a8b19a47d1071

Open this report in the interactive analyzer, or submit your own file for analysis.