Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a621c0b18d2e40f…

MALICIOUS

PDF

77.0 KB Created: 2021-04-26 08:04:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fd693ff8e0819165be802cd748f04520 SHA-1: 2f75919e6635793ef4b415363a06d9ffb73481fd SHA-256: 1a621c0b18d2e40fca5c80429261c58010ba9d7ee469039aa51b9a6bcaf8ccaa
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many pointing to disposable domains, and is flagged by ML classifiers and ClamAV as malicious. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a deliberate attempt to create a link farm on disposable hosting, likely for phishing or malware distribution. The presence of external URIs and the overall structure strongly suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=mustang+owners+club+uk+cars+for+sale
    • http://yandex-dostav.ru/pavemagilezunubeliwidutis0w61.pdf
    • http://betomererag.iblogger.org/pobepodip.pdf
    • http://about-igsupport.com/what_is_the_life_expectancy_with_alsjrcph.pdf
    • http://jiwapadenejeza.getenjoyment.net/norcold_refrigerator_quit_working.pdf
    • http://igme.site/the_god_of_small_things_summary_in_hindiqacez.pdf
    • http://bumaga.bz/getting_to_know_arcgis_pro_2.6_third_editionnp8uq.pdf
    • http://dewisazovuvoxi.mywebcommunity.org/how_to_pair_remote_control_to_samsung_tv.pdf
    • http://podjem2.club/best_launcher_for_android_tv_boxke83p.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://acbe2b0b-ee64-4eea-b0ce-372b1aa9cc7a.filesusr.com/ugd/4bcc67_f1d6b968d6934430b1ae76588f7c7efe.pdf?index=true
    • http://zifokorakimedak.rf.gd/89092430841.pdf
    • https://a581e706-3bf6-41fb-8978-ad4d4077590d.filesusr.com/ugd/afbe6b_969c7471a119419f9e94fe205a0587fb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a262a711-6105-4b98-96e4-a1b4192d22c8/laboratory_management_principles_and_processes_third_edition_ebook.pdf
    • https://uploads.strikinglycdn.com/files/8cc59cde-2572-4ed7-9250-1a335554bc8d/honeywell_th8320u1008_factory_reset.pdf
    • http://palinimawibiw.rf.gd/viwuninobej.pdf
    • https://uploads.strikinglycdn.com/files/4aa54c4a-7764-49db-9888-2b2273f94b16/how_to_service_ge_washing_machine.pdf
    • https://cc6d8859-fc08-4100-a073-55b48c5addfc.filesusr.com/ugd/238140_1ac3cd408ebb4f16b1a515923208feb3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c865dcaa-7e39-4dbf-89ab-e3d78c3cdcdf/70380470209.pdf
    • https://6d5fec37-5936-4ae8-8938-03a86e982f09.filesusr.com/ugd/d4da64_0b9e1662966c4430b2e732c2a7dd97d3.pdf?index=true
    • http://jisufosesuku.epizy.com/free_download_reader_for_pc.pdf
    • https://44b3a7a5-560a-4dc8-bf2c-49d9b11486fe.filesusr.com/ugd/fe0276_e67d6ea9b2a948ff9b8ae8272b4f0e3d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef10.bin
9ad59f48244328df68901ccc58a3e94c6df9f1616fadb0a289a3067011c23f51		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF10 5352 bytes
font_01_sfnt_off00010177.bin
7721690c8bf18df33ff84d913c1f73e252d95e760a417df8a678efe07e99140e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10177 10988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.