Malicious PDF — malware analysis report

Static analysis result for SHA-256 20fb45767a00b9e3…

MALICIOUS

PDF

79.1 KB Created: 2021-03-04 20:17:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 00d89ac3c647f70fbb8eb3747e884e06 SHA-1: 702e0912e792d1736c0c5569a9cb82d84db906b9 SHA-256: 20fb45767a00b9e3a26f3de71d552658014bbc92981be2e5143ceb210d36a1b0
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that directs users to a suspicious domain, disguised as a search result for a common query. This heuristic, combined with ML and ClamAV detections, strongly suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=how+to+fix+a+surging+engine PDF link annotation
    • https://zuxosudeti.weebly.com/uploads/1/3/4/3/134359900/pojabofaxovip_nipija_digigifuvopirep_wasopi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446166/normal_6001e774107bc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443823/normal_6040fa1bc7eaf.pdfIn PDF document text
    • http://kazerurido.iblogger.org/10924187581.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410414/normal_600f9f0d8e275.pdfIn PDF document text
    • http://tiwelonepozafuw.iblogger.org/40400636864.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451217/normal_6018662f5d22c.pdfIn PDF document text
    • https://wuwosafojopog.weebly.com/uploads/1/3/1/4/131407683/4010551.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376606/normal_6025c2083a661.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479224/normal_602980527504e.pdfIn PDF document text
    • http://rotiwopofeze.mywebcommunity.org/83126713417.pdfIn PDF document text
    • http://zisuroto.mygamesonline.org/vocabulary_booklet.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412908/normal_5ff254e53dff7.pdfIn PDF document text
    • https://rifodajawu.weebly.com/uploads/1/3/0/7/130739776/keles.pdfIn PDF document text
    • https://sutogibigasoju.weebly.com/uploads/1/3/1/0/131070189/1f742b0434820e8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://raziwisubuza.rf.gd/rational_expression_worksheet_1_simplifying_answers.pdfIn PDF document text
    • http://kosuvoz.epizy.com/oster_rice_cooker_oatmeal_recipe.pdfIn PDF document text
    • http://luvopekun.epizy.com/street_fighter_iv_hd_apk_obb.pdfIn PDF document text
    • http://xamazaxalezamat.rf.gd/89755686605.pdfIn PDF document text
    • http://nepokuwaporot.rf.gd/what_does_it_mean_when_my_nikon_coolpix_says_battery_exhausted.pdfIn PDF document text
    • http://tituroxir.rf.gd/course_completion_certificate_template.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA99 5024 bytes
SHA-256: 2f22080fc788151d146d1d24bd534a0740de2759bd963345fec8319517b178a6
font_01_sfnt_off00010bd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BD5 10324 bytes
SHA-256: ea70ac7005b640231ec2dab3c94e58fde7208539adff96bd3f8bce5670b2081f

Open this report in the interactive analyzer, or submit your own file for analysis.