Malicious PDF — malware analysis report

Static analysis result for SHA-256 23320285e24965e1…

MALICIOUS

PDF

101.5 KB Created: 2021-04-27 08:59:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: b4266c9ba149954eebd85079813c19d5 SHA-1: 3c56d0e0dc363ba484b52fc7a7dc5ea853394380 SHA-256: 23320285e24965e1907118970c18713d9fdcd4bde634231a4e6e31fffef57332
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating maliciousness. The document contains numerous embedded URLs, with a primary external URI pointing to 'https://dugedepap.ru/strik'. This suggests the PDF is designed to redirect users to a malicious site, likely for phishing or to download further malware. The presence of embedded URLs and the overall structure align with a spearphishing attachment attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=list+the+materials+necessary+for+photosynthesis PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4415292/normal_5fcebfcc43381.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4499329/normal_601f9a3bf0a2b.pdfIn PDF document text
    • https://cdn.sqhk.co/wadupaxi/Khehahc/piwubezibezofe.pdfIn PDF document text
    • https://cdn.sqhk.co/tolebilu/EjaifFh/musigibol.pdfIn PDF document text
    • http://requiredjokblog.com/minecraft_astral_sorcery_constellations8fyia.pdfIn PDF document text
    • https://cdn.sqhk.co/vituxezij/gjShfjg/zekovarovixomu.pdfIn PDF document text
    • http://gizigevom.mygamesonline.org/parabolic_reflector_antenna.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410006/normal_60243df550fa0.pdfIn PDF document text
    • http://wepirafigezatid.22web.org/harley_davidson_sportster_883_service_manual_free_download.pdfIn PDF document text
    • http://sipezolenanuwep.22web.org/99062651363.pdfIn PDF document text
    • http://vizionsmc.net/good_christmas_trivia_questions_answerbzq5v.pdfIn PDF document text
    • http://cashbackk.site/5455953328ei9zb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://47a25507-5c4f-4e73-9b7c-0c49514c8174.filesusr.com/ugd/e00bd3_58a7ad7e15334cdeaaa9c4b93a8f0bd0.pdf?index=trueIn PDF document text
    • http://bumurulepowele.myartsonline.com/95442525426.pdfIn PDF document text
    • https://3c59ccad-08dd-474b-8af0-a42d91f20399.filesusr.com/ugd/489ff0_b1214bd4c1d64c089f0120ea319e477e.pdf?index=trueIn PDF document text
    • http://mojozore.myartsonline.com/dasujekudazudipuzi.pdfIn PDF document text
    • https://d0fd22f1-78bd-4368-960d-2a324028b2bb.filesusr.com/ugd/a4d998_3b3f8742d109473fbe0d19b1dfc70444.pdf?index=trueIn PDF document text
    • https://307a23dc-bb60-4906-9a68-69e45957aa19.filesusr.com/ugd/d2057d_d6416804b9894d468f5115933a7600b6.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000139a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x139A9 5300 bytes
SHA-256: 092dfb505a34e4c7bb49ab25c5585d47b9f449a0e541d85bd655a2a4f4939083
font_01_sfnt_off00014b8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B8E 11504 bytes
SHA-256: 8089035def685f7c8bb09dcc630eb73c42c4e9ee47b86ecaa9630689a5a9d34c
font_02_sfnt_off000172c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x172C7 16244 bytes
SHA-256: 8aaed7eb49a0b9344f82a463f00ff20cdad24c34fc5a801a831337a92e674342

Open this report in the interactive analyzer, or submit your own file for analysis.