Malicious PDF — malware analysis report

Static analysis result for SHA-256 288c1560d6651c04…

MALICIOUS

PDF

90.2 KB Created: 2021-05-10 06:00:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 13d5ca9e2521cc80478afdf930eb1312 SHA-1: 2e14a1c0af5cf90735f0536549980755a7b250ba SHA-256: 288c1560d6651c04400455ba88209723702e74bf3078803fe984297723cfbf65
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one prominent URL suggesting a lure related to a TV show. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware delivery. The presence of many disposable domains and link farms further supports a malicious campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=watch+the+alienist+season+1+episode+9 PDF link annotation
    • http://blekrossi.ru/diablo_3_donjon_densemble_ombre79uf5.pdfIn PDF document text
    • http://shtangennstutkupitseychas.xyz/history_of_the_world_i_guess_reactionj22cf.pdfIn PDF document text
    • http://dmgameplan.com/retitodupimojg4gvu.pdfIn PDF document text
    • http://ig-socialmedia.xyz/43863280775qpzxn.pdfIn PDF document text
    • http://it50disconto.pro/rslogix_5000_manual_tutorialr8sfr.pdfIn PDF document text
    • http://fafaviga.iblogger.org/mfj-945e_for_sale.pdfIn PDF document text
    • http://newsportstechnology.ru/knowledge_of_self_islamhtelk.pdfIn PDF document text
    • http://bridgecommerce.com/205278004471a91c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://73808e0e-d5df-4584-b63e-1552d949bc0c.filesusr.com/ugd/8d2ea6_003fac068292422681e52aea24a685c1.pdf?index=trueIn PDF document text
    • https://d6ac5066-27fc-4e71-a07d-b30af50dfe8b.filesusr.com/ugd/934fc3_453dbc95f53d4832a0c72ab46bbd6373.pdf?index=trueIn PDF document text
    • https://0a497e50-07dd-462d-832d-d8678f741a8e.filesusr.com/ugd/5f857b_3df8cb87655e4b8ab4420696f96f29aa.pdf?index=trueIn PDF document text
    • http://magajavopisili.epizy.com/lezutuvejanirevu.pdfIn PDF document text
    • http://bedegotix.epizy.com/jodubuloxibadipedaxafale.pdfIn PDF document text
    • https://s3.amazonaws.com/kumasala/43263385771.pdfIn PDF document text
    • https://s3.amazonaws.com/mojivikapeti/dinosaur_skeleton_puzzle_template.pdfIn PDF document text
    • http://refewededuxita.epizy.com/4297931111.pdfIn PDF document text
    • https://a68e2ff5-bf17-48e3-82d4-ceb975b85758.filesusr.com/ugd/760101_cf92355d77c84eecb46defe719e100f2.pdf?index=trueIn PDF document text
    • https://1fd079ea-3156-4ae8-a0b4-6153e0b529c5.filesusr.com/ugd/e66bf7_c12c5e9bf05b4914bec13d7306ec226a.pdf?index=trueIn PDF document text
    • https://98748e4b-3258-471a-903e-8ea98415cca0.filesusr.com/ugd/fd7405_502d2e89c3bf45c9a0544cdbce49f470.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001247f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1247F 5284 bytes
SHA-256: e4b29ffe6dfd07400ce7306dad39bbc1e28f8549da691e754989f160974b2402
font_01_sfnt_off00013689.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13689 10956 bytes
SHA-256: 2834fc8436245f76ecd3b7aaf58baff32329b5d66e5b1e7839270322913e6c76

Open this report in the interactive analyzer, or submit your own file for analysis.