Malicious PDF — malware analysis report

Static analysis result for SHA-256 2951d1d35186015a…

MALICIOUS

PDF

90.8 KB Created: 2021-04-05 23:04:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d4340255f7274735baf304af24d2483f SHA-1: 7eec9200e79db35623141f1fcfc4318f97e32f27 SHA-256: 2951d1d35186015a527d6aea397683f5a596baa81c38f68a0d3f47ce6fcc8beb
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with several pointing to disposable domains and link farms, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a malicious document designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=geometric+form+meaning+in+marathi
    • https://cdn.sqhk.co/tezofugowura/0jjuDih/rofudaxodutas.pdf
    • https://cdn.sqhk.co/vuvapolaxaj/4qCPDhc/zombie_gunfire_mod.pdf
    • http://fesetinidu.iblogger.org/61252001465.pdf
    • https://static.s123-cdn-static.com/uploads/4366048/normal_5fffd9b5aeeaf.pdf
    • https://cdn-cms.f-static.net/uploads/4417644/normal_6017dbaa2c529.pdf
    • https://cdn.sqhk.co/gukokefa/iaJv9up/battery_tender_charger_and_maintainer.pdf
    • https://cdn.sqhk.co/baxikomo/bKQjhjd/wild_kratts_rescue_run_games.pdf
    • https://cdn-cms.f-static.net/uploads/4471948/normal_603c12be5b965.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://vewomani.rf.gd/ice_fishing_guide_kenora_ontario.pdf
    • https://8f20b4bd-83f7-4a55-8c6f-e9501e2e061c.filesusr.com/ugd/c1c462_e54550d3c25e454d8c96c18519c02c3f.pdf?index=true
    • https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_6347937e14ff4c5aa2a49943d9ae0bb6.pdf?index=true
    • https://c183b790-cb34-49aa-848e-1a9f2b14dda3.filesusr.com/ugd/d8966e_b612853c191d46c6a83aec2f2547f657.pdf?index=true
    • https://5fdaa9e0-ad6d-443b-8779-beb8e45026dc.filesusr.com/ugd/05301a_e5f95782579948d4931027b9ff5cd4ac.pdf?index=true
    • https://uploads.strikinglycdn.com/files/217b8d14-4945-4af3-b6f1-9d0618be2d5f/23417495059.pdf
    • https://uploads.strikinglycdn.com/files/b2642397-3f40-4f32-a25b-2b91c341fc97/what_is_the_definition_of_communism_in_economics.pdf
    • https://7e70056c-c2aa-4e53-98c5-50750123c107.filesusr.com/ugd/f8ae5d_21fc57bea1834889a8ca9c45d43ceaad.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cdfa5741-a58d-4375-9d17-60f4ca888012/51959382221.pdf
    • https://s3.amazonaws.com/tabobujimo/nursing_anatomy_and_physiology_textbook.pdf
    • http://bopexetosezulav.rf.gd/bomb_squad_mod_folder.pdf
    • https://s3.amazonaws.com/petubapizo/73896214426.pdf
    • https://uploads.strikinglycdn.com/files/9813b730-975a-4463-b495-c7bd8826b036/kexofulexulasekixetov.pdf
    • https://s3.amazonaws.com/jovekus/dsc_power_series_set_time_and_date.pdf
    • https://uploads.strikinglycdn.com/files/6e3e5687-dc3e-4c06-adaa-690181966ef1/fizubawimapanikubovidu.pdf
    • https://s3.amazonaws.com/jidosatikim/available_apps_for_android_auto.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010190.bin
0f8815fa3e90f19778ccdb671d2b108c3122c2d22f35cfdfa64335415dc5347f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10190 4904 bytes
font_01_sfnt_off0001120b.bin
202a4714d3f0bc973ba77b0cd023243ee9d81cae3748f3770e3461eff9c7b16b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1120B 11576 bytes
font_02_sfnt_off00013a06.bin
0887bc94add3ccbae2623ecc1f1fe48d304d441f3d2189e3e5b876bc141dc419		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A06 16096 bytes
font_03_sfnt_off00014ed1.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14ED1 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.