Malicious PDF — malware analysis report

Static analysis result for SHA-256 237dd800a57463cf…

MALICIOUS

PDF

78.6 KB Created: 2021-04-07 15:20:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90bd88e25da7c603cc0a2fce2a22a7b6 SHA-1: ac38bb706c8e14e166276822287d54057ea03b93 SHA-256: 237dd800a57463cfa7d22fb9c17525158fa55e601da5b431ee95b40175c36ad4
106 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an invisible link pointing to 'http://loginwithfb.site/how_to_change_hands_on_a_clock6frf8.pdf', which is a high-risk indicator for phishing or malware delivery. The document also includes other suspicious URLs hosted on disposable domains, suggesting a link farm or redirection scheme. While no scripts were directly extracted, the overall structure and embedded links point towards a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=how+to+get+cpc+for+amazon
    • http://jolijivik.scienceontheweb.net/aptitude_test_paper.pdf
    • https://xupugafowepeg.weebly.com/uploads/1/3/0/8/130814457/5598193.pdf
    • http://csxmoney.info/35438267723wukkd.pdf
    • http://mon-cmbretagne.com/womebojawsn7d5.pdf
    • http://matrixbicycles.com/how_to_write_an_e5_evalbhzgt.pdf
    • https://jikezukirex.weebly.com/uploads/1/3/1/3/131383594/wabanifofifoba.pdf
    • http://dumubemajizukov.medianewsonline.com/can_i_upload_my_dna_from_myheritage_to_23andme.pdf
    • http://bella24.xyz/journal_entry_for_outsourced_payroll_in_quickbooks8uzwy.pdf
    • http://tryplafond.xyz/percy_jackson_sea_of_monsters_book_plot_summaryhxuf1.pdf
    • http://kismyketio.com/365971953608kb5l.pdf
    • http://loginwithfb.site/how_to_change_hands_on_a_clock6frf8.pdf
    • https://nawajutexi.weebly.com/uploads/1/3/4/1/134108687/7704655.pdf
    • https://cdn-cms.f-static.net/uploads/4466386/normal_5fdc23bb6d279.pdf
    • http://lenudes.com/329126736906p7uv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0aa989e7-076c-475f-bc22-fff5ae310860.filesusr.com/ugd/b44be6_de7dae797bac4e4a84e48569a1e5dc5c.pdf?index=true
    • https://200ee3fc-349d-4871-b5c3-2c1c69b60476.filesusr.com/ugd/7b00a0_9ca2eefbfe394bb5a9c3954b80c14bb9.pdf?index=true
    • https://51364a6b-283d-4537-b9df-48522fd8faf2.filesusr.com/ugd/921180_2a8f7918d8fa49daa43782a58530ee48.pdf?index=true
    • https://e6b56e3c-1b88-4cfb-972d-ab1702b0a06e.filesusr.com/ugd/8c0e65_e4963d15686f411da521e3bd05e83a95.pdf?index=true
    • https://4dcfe184-cd6c-48f8-9f23-5461c743a1d4.filesusr.com/ugd/cc8533_b634fd2b127c49089db0c3f90b467a4b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2a5.bin
d50429e16e32b262611172604187d50f138fea5fff9c33385a869ab14d04f73a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2A5 5228 bytes
font_01_sfnt_off00010480.bin
a72e76bb66b8a983fe7bb65b7e1753f2829e52e0b377037cf02acec37f6aff2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10480 13072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.