Malicious PDF — malware analysis report

Static analysis result for SHA-256 22ff2e244bb59651…

MALICIOUS

PDF

76.1 KB Created: 2021-04-27 10:40:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 16b51a0c8d0e2e31e94f0682f51a0189 SHA-1: 99b1f860ceba096a84dd4f95aaabcfe0e80749b2 SHA-256: 22ff2e244bb59651293b23f4b85298a5372a48794456be0d90a79487acb243f9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs pointing to disposable domains and link farms, indicating a likely phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to external malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=samsung+galaxy+s9+plus+release+date+uk PDF link annotation
    • https://cdn.sqhk.co/xumifutave/5WDxjf0/airplane_mode_games_android.pdfIn PDF document text
    • http://evatopshop.xyz/does_bernat_blanket_yarn_have_a_dye_lotdtn01.pdfIn PDF document text
    • http://kapusta.pro/toverepibaxibilegogerisc6m6z.pdfIn PDF document text
    • http://venovagom.iblogger.org/43657386453.pdfIn PDF document text
    • http://batmbatm.ru/44198823179bbyr1.pdfIn PDF document text
    • http://timecodes.net/polyprotic_acid_worksheetbxg9o.pdfIn PDF document text
    • https://cdn.sqhk.co/wolanojijen/heggpgi/waduxutijonetikenofuxe.pdfIn PDF document text
    • https://cdn.sqhk.co/foropogajag/gvccDGN/ziponabu.pdfIn PDF document text
    • https://cdn.sqhk.co/sidogorego/JidgjNE/98247677138.pdfIn PDF document text
    • https://cdn.sqhk.co/netimawifes/geoIXgj/zowegif.pdfIn PDF document text
    • https://cdn.sqhk.co/bagudivibi/eiajcq6/spider-_man_rope_hero_games.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://7c3a386c-9197-44ff-a2a0-26a6be1b6260.filesusr.com/ugd/bba797_e0dc3642f429460897622d487459a132.pdf?index=trueIn PDF document text
    • https://d3df31c7-72fe-42b1-a92e-0723e8ed7a16.filesusr.com/ugd/5bf82b_a8916a9a9a8c41d8b898db02c145393f.pdf?index=trueIn PDF document text
    • https://62619d47-812b-4c4f-a232-aa08d86264e8.filesusr.com/ugd/6d62c1_9d64eb0e241f4fb1b8a08457526bfcc7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/88a3cb5c-498e-4669-8860-ab0c8129c394/37269343375.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d16c8a8-ed4b-4645-a590-bc707da2653a/learn_how_to_speak_basic_korean.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30c17472-15c1-4db4-833c-acf9114a5c65/pozenidirufudajapezoroga.pdfIn PDF document text
    • http://tutonewi.epizy.com/99536037922.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a4ef6f7-2083-4f60-8540-ee191d8a656b/wuzekunonodatafus.pdfIn PDF document text
    • https://c2267750-1f6d-4c2f-944a-eb302c7f07d7.filesusr.com/ugd/93971e_e3bc5b56c1cf4b17abcb20adf17592e5.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e929.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE929 5772 bytes
SHA-256: 2dd01d4a777fb5adfcbf89162d31c6e20b5bb746eabd9cfb297a410a892a8811
font_01_sfnt_off0000fcc3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCC3 11028 bytes
SHA-256: 68d2d1ad8978c927ba6262be0e48eae1c3aa684ca57af666c43ad1669a71c076

Open this report in the interactive analyzer, or submit your own file for analysis.