Malicious PDF — malware analysis report

Static analysis result for SHA-256 2915613ee10d3b39…

MALICIOUS

PDF

82.3 KB Created: 2021-03-15 11:15:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ec6dfb14594b1f00d2c2db7ce1d2b226 SHA-1: d577091efaf1a82bed26a63f7bb0f9e4139a1e3d SHA-256: 2915613ee10d3b3997e0b29aaa7b1ac9afffb1cf499bf7ddf9a49a313fdefd32
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many of which point to disposable hosting and are likely part of a link farm designed to redirect users to malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution. The document body, though heavily obfuscated, appears to be a lure related to appliance repair queries.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=why+isn%2527t+my+lg+washer+spinning
    • https://suviliter.weebly.com/uploads/1/3/1/4/131453542/gekapojum.pdf
    • http://interbank.link/pocket_tajweed_quran_with_english_and_transliterationkqjh0.pdf
    • http://brosbass.com/sebi_listing_agreement_clause_49foq5g.pdf
    • https://cdn.sqhk.co/laxefotogulo/hajafev/97317631125.pdf
    • https://tugofemupufere.weebly.com/uploads/1/3/4/5/134584107/difimebekexupad_webutelis_wowunojap.pdf
    • http://midimox.getenjoyment.net/biochemistry_journals_2020.pdf
    • http://clubstore.info/is_divergent_suitable_for_11_year_olds47yt9.pdf
    • http://pokupka.space/26366717714n2dkh.pdf
    • http://presentinsta.site/lazoroxedinujoteli2729k.pdf
    • http://egosikenclub.com/mystic_messenger_email_answers_lololbq9ue.pdf
    • https://wokonupojelofa.weebly.com/uploads/1/3/5/3/135351156/fovuta-nanerir.pdf
    • http://domavera.ru/87652083830mz905.pdf
    • http://movizopolu.medianewsonline.com/73766552120.pdf
    • https://wiloropijevor.weebly.com/uploads/1/3/5/2/135299547/9740612.pdf
    • http://neditaxuvim.getenjoyment.net/toro_724_snowblower_auger_belt_replacement.pdf
    • http://bettyloustintruckbbq.com/creating_alliterative_phrases_worksheet_answer_key58kw1.pdf
    • http://invitesistem.ru/besazizitipileucy6r.pdf
    • http://sosiwawivijomo.scienceontheweb.net/troy_bilt_42_mustang_zero_turn_blades.pdf
    • http://rollernefritmassage.xyz/58556390990gp940.pdf
    • https://cdn.sqhk.co/pasededi/vihhifp/5514473527.pdf
    • https://nodimawajovuri.weebly.com/uploads/1/3/4/4/134431691/7064ea24ae8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jozobudesurarab.onlinewebshop.net/estimating_the_prevalence_of_human_trafficking_in_the_united_states_considerations_and_complexities.pdf
    • http://nowimirozox.atwebpages.com/gijugafaxuziso.pdf
    • http://rabatelekovufar.myartsonline.com/32372425566.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010383.bin
79229b4d1d008620e0018bb0e461dc516ab8b3f8af17048f2f3bc78dc421c6ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10383 5472 bytes
font_01_sfnt_off0001161b.bin
b6648bb3ba1a55f0e2c4c550f0ebd223542d2dd591de60402d7398ad8abc641c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1161B 10592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.