Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a406549cbfee32e…

MALICIOUS

PDF

73.8 KB Created: 2021-03-27 22:51:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: d42982165413d0d1af41ad78dd53308a SHA-1: a82cc38665996cf01df1fa518e28e289ca05c2fa SHA-256: 1a406549cbfee32e2c6ddfd2ac6d78f19ce599bc8b7d1f172b83e637b862c151
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to disposable domains, suggesting a link farm designed to redirect users to malicious content. The presence of external URIs and the 'link farm' heuristic strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/123?utm_term=astrology+answers+cancer+weekly PDF link annotation
    • http://botanilix.mygamesonline.org/retinopatia_diabetica_articulo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371791/normal_603a75fcebc0b.pdfIn PDF document text
    • https://cdn.sqhk.co/bomoxale/iijajca/47903099381.pdfIn PDF document text
    • https://cdn.sqhk.co/suwojixuwebi/cghhghd/mr_ninja_ninja_stars_level_186.pdfIn PDF document text
    • http://mavixepajifulem.scienceontheweb.net/banking_awareness_affairscloud.pdfIn PDF document text
    • http://giwosoto.sportsontheweb.net/adverbs_exercises_intermediate.pdfIn PDF document text
    • http://rumafelaneli.mygamesonline.org/dilation_and_curettage_procedure.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451575/normal_604ca3d940b36.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xidulumexi/samsung_front_load_washer_error_codes_4e.pdfIn PDF document text
    • https://34570882-574e-4d25-8c0e-d8b9b6c2967f.filesusr.com/ugd/cb2bed_7e61761462f941bfb2e7cb3b25085029.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wezukep/bapodakumozesevo.pdfIn PDF document text
    • https://441768bb-9839-4df4-8f78-dd1233b527f6.filesusr.com/ugd/7e6080_4ee8992070534f59bd886553a9f82437.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8e6183b-4dc3-4f62-804a-16227780ea40/how_many_red_cards_in_a_deck_of_52_cards.pdfIn PDF document text
    • https://s3.amazonaws.com/xarojapi/cumulative_frequency_graph_questions_and_answers.pdfIn PDF document text
    • https://70010cfe-69b1-4fe9-a336-bdfe2418dc1e.filesusr.com/ugd/f1d680_d673d6fc521a404ca8cfccef9d155679.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/13494752-69a3-496a-96bf-aaaf8965335a/narrative_of_the_life_of_frederick_douglass_themes.pdfIn PDF document text
    • https://d5f1d3db-1598-48d0-a061-764c190a6564.filesusr.com/ugd/866690_7ea8635ca7f04b9ebb72600b537133f3.pdf?index=trueIn PDF document text
    • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_60ee892e841f430e8edef7d4ac23b66d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6a6faa9-77e7-4df9-9f82-6c0aaf610171/why_does_my_guitar_sound_bad_with_a_capo.pdfIn PDF document text
    • https://s3.amazonaws.com/nasitevu/82861361823.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e48d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE48D 5212 bytes
SHA-256: 72be4d01dfbdfb356bc1b9f8d290111727b46023bef96d1010f982a5cd8f50df
font_01_sfnt_off0000f677.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF677 10368 bytes
SHA-256: fa1fa609f04c6916551d7236af02b88aec8b59498b6e0aa7c6452a11362bf68c

Open this report in the interactive analyzer, or submit your own file for analysis.