Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d9d538e87d7e322…

MALICIOUS

PDF

92.3 KB Created: 2021-03-22 22:38:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cb3d30920c0fbd3c3d0a0d1036aab148 SHA-1: 85c92794d3647f5bf019f3e62cc8da8ced1cf00c SHA-256: 1d9d538e87d7e32266d9dee4b616a2ff751ed679668f41004e537619e0a1716e
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with a high-confidence heuristic identifying it as a link farm on disposable hosting. The primary URL, https://midufefew.ru/wix?keyword=twins+spring+training+tv+schedule+2019, is likely a lure to a malicious site. ClamAV detection and ML classification further support its malicious nature, indicating it's a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=twins+spring+training+tv+schedule+2019
    • https://cdn-cms.f-static.net/uploads/4412606/normal_5fe70ab4b0e19.pdf
    • http://benivosefemiza.medianewsonline.com/87178250956.pdf
    • http://nebemor.mywebcommunity.org/healthy_breakfast_ideas.pdf
    • http://tejowigasinafu.getenjoyment.net/ninja_smoothie_recipes.pdf
    • https://xurebutira.weebly.com/uploads/1/3/2/6/132681359/mizudupodalabew_sijeves.pdf
    • https://ligavovifoma.weebly.com/uploads/1/3/4/5/134522072/3249570.pdf
    • https://mimuromujalu.weebly.com/uploads/1/3/0/7/130739347/981581.pdf
    • http://zobotalemogi.sportsontheweb.net/worldwide_cost_of_living_2020_the_economist.pdf
    • https://static.s123-cdn-static.com/uploads/4408346/normal_5fcd2cb127c55.pdf
    • http://nenegifivujaxu.mypressonline.com/55996232513.pdf
    • https://tavulejitozusol.weebly.com/uploads/1/3/0/8/130873759/nobenivisipoze.pdf
    • http://gazizelasama.getenjoyment.net/13_powerful_quotes_about_inner_strength.pdf
    • http://famafivas.iblogger.org/61889876224.pdf
    • https://cdn-cms.f-static.net/uploads/4420454/normal_5fd632fcdb665.pdf
    • https://dopovubejaxow.weebly.com/uploads/1/3/4/0/134017692/mupufataxi-wubisakeko.pdf
    • http://xepokex.iblogger.org/julefedizivudenu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://sodividupoz.epizy.com/what_are_the_different_phases_of_software_development_life_cycle_sdlc.pdf
    • https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_3d6cdf89e6d846858c46a6d9a366d41c.pdf?index=true
    • http://voturugivorajop.onlinewebshop.net/nsou_assignment_cover_page.pdf
    • https://37bcb4aa-7747-4ff6-a352-0e22bf983c21.filesusr.com/ugd/4393d3_5ae63da417ce4adeac947b7d7821c1ae.pdf?index=true
    • http://jedebusarotatux.epizy.com/il_playbook_di_barney_stinson.pdf
    • http://miwilodugifi.rf.gd/mixokivuvajitogebi.pdf
    • https://b2f3f1fb-4f3f-4d5d-be65-f5b10dce6288.filesusr.com/ugd/735189_34e54bc9aa2645878cbe57b3dcce19a0.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011bb2.bin
c6e1fb149886c42b240d58cfc47490ca9ff4ecb5207fb9b8309d938b8e65f143		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BB2 5688 bytes
font_01_sfnt_off00012f13.bin
dca4dab943e3e758875092a00f8e4ab74ef83034b584bf8ea63d1943c4580771		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F13 11240 bytes
font_02_sfnt_off00015534.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15534 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.