Malicious PDF — malware analysis report

Static analysis result for SHA-256 18932043b0f07481…

MALICIOUS

PDF

74.0 KB Created: 2021-06-09 03:06:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: d940f35e14ac50c991738be1990dd2d7 SHA-1: 3f1387b43e35c6a7decaa84edb523008538b729a SHA-256: 18932043b0f074812cc7c443609a143e68c723bf08737b7bbc637d9e4c30ec05
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, which is likely used to redirect the user to a malicious site. The PDF structure and embedded content suggest it's part of a phishing or malware distribution campaign, potentially using a link farm to obscure the final destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/pbw?utm_term=nonton+the+human+centipede+3+full+movie PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4454286/normal_5fed999617eff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408865/normal_604726729e881.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412999/normal_6051f4333374c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418566/normal_6016e5508fa8e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c617b21a-934c-4447-afa8-0568be63e3b0/what_does_the_code_4e_mean_on_my_samsung_washer.pdfIn PDF document text
    • http://bawamotijeku.pbworks.com/f/how_to_change_netflix_password_on_firestick.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac221d05-020b-4839-ac36-19ef049310e8/62215756088.pdfIn PDF document text
    • http://disisopaz.pbworks.com/f/patupisokufowodofalepes.pdfIn PDF document text
    • http://jojekepodef.pbworks.com/f/sociology_o_level_notes.pdfIn PDF document text
    • http://negovijalulu.pbworks.com/w/file/fetch/144418512/32413960523.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/614b5f0e-2ff0-4720-855d-bfa607053335/bazelomutubunufuweja.pdfIn PDF document text
    • http://wirajudukim.pbworks.com/w/file/fetch/144760143/poder_general_para_actos_de_dominio_o_de_administracin.pdfIn PDF document text
    • http://zewalar.pbworks.com/f/mawuvipajixade.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b9e54b6-1ebd-4608-a780-7a1ddd9d5d8a/99168263014.pdfIn PDF document text
    • http://texuxokubu.pbworks.com/f/vehicle_registration_information_punjab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2461f2c9-45a3-4529-83a3-cac8638baf14/50264320831.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/493900c9-cfb6-40a4-8c42-c27eac62eb96/phrasal_verb_get_esl_activities.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd6a2339-5730-4ece-ac06-10621c424f37/vudetezutaki.pdfIn PDF document text
    • http://zusemivak.pbworks.com/w/file/fetch/144744513/what_is_the_principle_of_uv_spectrophotometry.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2da5f4c8-04a8-4e59-9b92-705e50749d6d/recep_ivedik_4_indir_full_hd_tek_para_izle.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e246.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE246 5316 bytes
SHA-256: f6aae5b5d0909952aaa20a660b8599d7a268a14a6368fddbc7ac9bac0e7e8f1d
font_01_sfnt_off0000f448.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF448 11352 bytes
SHA-256: 8a4da90f1807ebcebd17552e8ba1461ee18bd491958d7e37807b50b744daca77

Open this report in the interactive analyzer, or submit your own file for analysis.