Malicious PDF — malware analysis report

Static analysis result for SHA-256 2bb8407db18a3a84…

MALICIOUS

PDF

70.7 KB Created: 2021-06-03 05:25:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c86628574642ae12dd1fb718830804cb SHA-1: 64085306e95c0843e28df13363233dc7e410217d SHA-256: 2bb8407db18a3a84a8ec5b6d49d124a7035afd2ff8faccebdab25e8d64505dd8
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating it's a phishing or trojan attempt. The embedded URL, disguised within the document's content, leads to a site that appears to be a link farm, likely intended to redirect users to malicious content. The primary attack vector is likely spearphishing attachment, with the PDF itself serving as the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/pbw?utm_term=what+qualifies+for+housing+allowance
    • https://static.s123-cdn-static.com/uploads/4490724/normal_5ff93479a3aec.pdf
    • https://cdn-cms.f-static.net/uploads/4473616/normal_604a5eccda4c9.pdf
    • https://static.s123-cdn-static.com/uploads/4444648/normal_5ffeb8855f153.pdf
    • https://cdn-cms.f-static.net/uploads/4369923/normal_603b9543a576b.pdf
    • https://static.s123-cdn-static.com/uploads/4481522/normal_5ffdebd706087.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0500ab7a-ae75-4a2f-8c89-00bff001edbe/is_it_easy_to_learn_html_and_css.pdf
    • http://vibasuvezuz.pbworks.com/w/file/fetch/144503406/tinapifofavunipib.pdf
    • http://bepisoxu.pbworks.com/f/textnow_apk_old_version_4.42.0_download_apk.pdf
    • http://mutoteja.pbworks.com/w/file/fetch/144505773/le_royaume_de_kensuk_rsum_chapitre_1.pdf
    • https://uploads.strikinglycdn.com/files/4e67414a-3ed2-465d-9b03-47603dab33d3/regular_ar_verbs_conjugation_spanish.pdf
    • http://degenazi.pbworks.com/w/file/fetch/144431610/88919338521.pdf
    • http://lulimogosan.pbworks.com/f/how_to_get_free_fire_diamond_in_nepal.pdf
    • http://bezawagiga.pbworks.com/f/how_much_do_2020_dodge_challengers_cost.pdf
    • http://felefejimax.pbworks.com/f/93311480386.pdf
    • https://uploads.strikinglycdn.com/files/699743d0-f5f8-4049-8806-d8acb34f303c/focusrite_scarlett_solo_driver_windows_7_download.pdf
    • http://kuzimotum.pbworks.com/w/file/fetch/144532206/goguderer.pdf
    • https://uploads.strikinglycdn.com/files/8b2a9ca1-7c6e-4122-a64b-1aac7de141fd/tubajifalulesitenifu.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de17.bin
db809ae84d9af25e7a1adfb6b007d115178033e9ffb67e221db54a8ccd7c3a9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE17 5376 bytes
font_01_sfnt_off0000f075.bin
6367a88a7d69b19ef1e15d0b2a0851a9f30f178ca6f1cd0b2678fd7e164f3a61		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF075 10628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.