Malicious PDF — malware analysis report

Static analysis result for SHA-256 2afd3cc8292a3429…

MALICIOUS

PDF

89.4 KB Created: 2021-04-04 23:45:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0e2cc95017db04aba8dd5368396fbc65 SHA-1: 739a9f27b6f515a659b905833dacbbe924a09f23 SHA-256: 2afd3cc8292a34299b4e3e6b838e59d0e0443e9f37c1443643a61fa973092e94
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains multiple external URIs and is flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The presence of a 'download button' heuristic further suggests a lure to download a payload. While no scripts were extracted, the overall structure and heuristics indicate a phishing attempt designed to trick users into downloading malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=active+voice+exercises+pdf
    • http://dajobod.getenjoyment.net/murejaliba.pdf
    • http://fubikopelemom.mypressonline.com/64311993536.pdf
    • http://rutinesuzufogat.mypressonline.com/98092545499.pdf
    • http://keniworu.mywebcommunity.org/ibps_clerk_maths_book.pdf
    • https://dagazafija.weebly.com/uploads/1/3/1/4/131484603/573188.pdf
    • https://dakufosaxem.weebly.com/uploads/1/3/4/7/134771611/xotalex.pdf
    • https://nezejigon.weebly.com/uploads/1/3/4/6/134611081/cd833c1a3a61.pdf
    • https://kitabenulo.weebly.com/uploads/1/3/0/9/130969432/3007613.pdf
    • http://likedizar.medianewsonline.com/netgear_wnr3500lv2_review.pdf
    • http://gakukuketisalum.scienceontheweb.net/2008_jeep_grand_cherokee_headlight_removal.pdf
    • http://tigesonepovar.66ghz.com/coagulopathy_in_chronic_liver_disease.pdf
    • http://volelovapudexif.scienceontheweb.net/desavakajolapogojodokolur.pdf
    • http://kugiriteno.iblogger.org/cambridge_international_dictionary_of_idioms_free_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xirozaza.onlinewebshop.net/vatenesuwejefazavemevu.pdf
    • http://buziluzune.epizy.com/thomas_finney_calculus_9th_edition_solution_manual_free_download.pdf
    • http://zivositad.rf.gd/admission_form_allama_iqbal_open_university_2018.pdf
    • https://uploads.strikinglycdn.com/files/4ac54fab-769f-4caa-8af1-2607f9eff2d3/51313563413.pdf
    • https://uploads.strikinglycdn.com/files/69f25294-92a8-4ef9-a55a-c8fd6eb3c7d8/fanegagutiwikegav.pdf
    • https://uploads.strikinglycdn.com/files/7ffb3616-3555-4495-80b7-00a9b94f6cc3/64154669282.pdf
    • http://nedukej.rf.gd/taco_bell_sodium_menu.pdf
    • http://lejaxofin.epizy.com/bartolinitis_tratamiento.pdf
    • http://fesononojowa.epizy.com/cctv_setup_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011ee0.bin
30ddda7347881ed4dfbe5865f10fbd76943dc6ae1079a3ebcc05d94aac9c7b95		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11EE0 5024 bytes
font_01_sfnt_off0001301b.bin
dc223ce372b2aebc9491630778759929ecf8889542d1d9bfd2adced98b070a8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1301B 11212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.