Malicious PDF — malware analysis report

Static analysis result for SHA-256 236e9db5c343b4f8…

MALICIOUS

PDF

76.4 KB Created: 2021-03-31 13:32:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9e1814e1e0f9770fcdb5b5b39aa78345 SHA-1: b62e37b5512e73db103c84ab2a1b3a505a4139a6 SHA-256: 236e9db5c343b4f83c0a24484195bb47a0a3c316ec8f700dd4c76e8899bfda0f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to disposable hosting and are likely part of a link farm designed to redirect users to malicious sites. The document body, though heavily obfuscated, suggests a lure related to product pricing, which is a common tactic in phishing and scam campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=acer+aspire+e15+price+in+nepal
    • https://judagurulo.weebly.com/uploads/1/3/1/4/131438873/8c1251b4d10.pdf
    • https://gemujofu.weebly.com/uploads/1/3/4/3/134372819/4835789.pdf
    • http://migerov.xyz/173512191931tozk.pdf
    • http://zinobinipote.22web.org/diccionario_larousse_espaol_apk_full.pdf
    • https://jixawapideraje.weebly.com/uploads/1/3/3/9/133997308/4052964.pdf
    • https://sijaxidav.weebly.com/uploads/1/3/4/4/134499987/08bfb.pdf
    • http://oneitstore.info/62269869057673y0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://973697ad-ffa4-4f9d-85cd-0c9d1ea039ee.filesusr.com/ugd/5f5755_3b1580c4ed66492e9402f563709abe68.pdf?index=true
    • http://zogaxemajov.epizy.com/33306831277.pdf
    • https://f5f74d4f-f804-4d9b-9bfa-9964b2756261.filesusr.com/ugd/e389b3_b1fc076d083d460d8fffa63b277b3aeb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9d8cd94d-6e39-4232-bde8-cbe0c61dac45/nemipur.pdf
    • http://bekegud.epizy.com/lyrics_cant_stop_the_feeling_from_dreamworks_animations_trolls__official_video.pdf
    • https://s3.amazonaws.com/damerirazib/xiwodipijolexeki.pdf
    • http://durevitulo.rf.gd/65446573045.pdf
    • https://s3.amazonaws.com/lurutopobi/antiochian_orthodox_liturgical_guide.pdf
    • https://uploads.strikinglycdn.com/files/25a64f81-1c04-4949-b04e-9ef5e5d5b6b0/the_monkey_king_3_2018.pdf
    • https://uploads.strikinglycdn.com/files/eeabef63-69c1-4f57-a006-c246ba033784/fantastic_fan_rv.pdf
    • https://uploads.strikinglycdn.com/files/b72eb3c1-35dc-4110-b5d8-21d34e55b479/speed_queen_commercial_dryer_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1c4.bin
ecc4c0763a08692135201f03e1301918fda01c2e2dddbc99f0f7e03797aa6096		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1C4 4692 bytes
font_01_sfnt_off0000f1af.bin
47efbd263127e557d8abef220aee5a0c7da6fb38f443044d39ac6824623abaca		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1AF 10732 bytes
font_02_sfnt_off0001165a.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1165A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.