Malicious PDF — malware analysis report

Static analysis result for SHA-256 278f7191335d54ae…

MALICIOUS

PDF

77.1 KB Created: 2021-03-05 08:55:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 5ae94ded363c9ffa35a582992059114b SHA-1: a852e9c7d3a8360d01b5e04f50858ce45364e1a1 SHA-256: 278f7191335d54ae82fe9ad41dcfbea5dfda7c4378e251b73fdf85684369ec72
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many of which are hosted on disposable domains and appear to be link farms. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' and the presence of multiple unknown-reputation URLs suggest a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or trojan delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=harrisons+manual+of+internal+medicine+pdf PDF link annotation
    • https://lifulufo.weebly.com/uploads/1/3/1/3/131379971/xotir.pdfIn PDF document text
    • http://lasleymarkt.ru/28178407783sk53e.pdfIn PDF document text
    • https://cdn.sqhk.co/votezevon/pjePzic/coloring_by_numbers_free_worksheets.pdfIn PDF document text
    • https://cdn.sqhk.co/rebamomidaw/hiJgcge/42558980378.pdfIn PDF document text
    • https://vosilidasum.weebly.com/uploads/1/3/2/7/132740263/bifasuladigekifovet.pdfIn PDF document text
    • http://vienvozvrat.site/60878464202i2a7e.pdfIn PDF document text
    • http://tiktokfrance.fun/pm_awas_yojana_online_form_2018tm131.pdfIn PDF document text
    • http://pearhaidhr.fun/city_skylines_industry_guideqlhqc.pdfIn PDF document text
    • http://bcpzonasegurape2-viabcp.com/call_of_duty_modern_warfare_patch_notes_1.110fhiy.pdfIn PDF document text
    • http://devgm.design/how_to_clean_a_browning_2000_shotgun2mmzx.pdfIn PDF document text
    • https://cdn.sqhk.co/wifuponi/ehbjbhd/bad_day_at_work_2020_part_10.pdfIn PDF document text
    • http://thecaffeinatedstudent.com/tarot_card_combinations_reader_in_jaipurlxoxz.pdfIn PDF document text
    • https://cdn.sqhk.co/vujaderaz/rgh0heH/fugoz.pdfIn PDF document text
    • http://amst-watch-v2.club/abecedario_ilustrado_para_imprimircg64i.pdfIn PDF document text
    • http://faceit.su/8930364550m7tmg.pdfIn PDF document text
    • http://tehnotop.store/40000147502gu5ao.pdfIn PDF document text
    • https://cdn.sqhk.co/rinovizifim/jjHcWDs/75502713794.pdfIn PDF document text
    • https://nelizozab.weebly.com/uploads/1/3/0/8/130874358/xutozimu.pdfIn PDF document text
    • http://reduslimitalia-official.site/sovereignty_crown_of_kings_guideffejz.pdfIn PDF document text
    • http://lighttravel-ng.com/diary_of_a_wimpy_kid_old_school_symbols7w28q.pdfIn PDF document text
    • https://mikedexe.weebly.com/uploads/1/3/1/4/131452733/zaliradasidowo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f770b3d7-c897-40e0-9323-5ad0abd91552.filesusr.com/ugd/1fa6dd_92e5fae0838b4977a1424bb2ba899123.pdf?index=trueIn PDF document text
    • https://c788b29d-df2d-4d46-9946-349e8cce89b7.filesusr.com/ugd/a9e086_6f41fd824bf94eeb8c0797dcd5bb1f21.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0EA 5260 bytes
SHA-256: 596132b3e5aee8213ee59f7a23b277abb431695231569b677d9c07d787d3e63b
font_01_sfnt_off000102b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102B7 10604 bytes
SHA-256: 1e19a8f460e94f980931e7de68e7747bbda57cffe8c0cbbb706f210768a01fc9

Open this report in the interactive analyzer, or submit your own file for analysis.