Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d7171b54255fc52…

MALICIOUS

PDF

73.3 KB Created: 2021-03-12 02:11:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: f95dda2695844e604878b1f633bbd9ba SHA-1: 107787e32730ad663d2b2694a8426f64a0fba6a9 SHA-256: 2d7171b54255fc5296dd2d1edf18731fe5b7a2a106f9e8d50a8b57d901841351
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous embedded URLs, with a primary external URI pointing to 'https://vilenefex.ru/award?keyword=coffee+grinder+manual+pdf', suggesting a phishing or malware distribution lure. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, but does not provide direct textual clues to the lure. The presence of multiple distinct hosts and a high number of links suggests a link farm used to obscure the ultimate destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=coffee+grinder+manual+pdf PDF link annotation
    • https://cdn.sqhk.co/xexogataza/MifOic2/run_2_unblocked_games_77.pdfIn PDF document text
    • http://sosiwawivijomo.scienceontheweb.net/25083937947.pdfIn PDF document text
    • http://wozekozexufoxol.scienceontheweb.net/rifudupomazikirilalir.pdfIn PDF document text
    • https://cdn.sqhk.co/jesotipo/6MgiCuR/85902077711.pdfIn PDF document text
    • https://cdn.sqhk.co/lexoxuxoluvi/hiaUghF/apple_cake_recipe_easy_healthy.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://sozidimimu.rf.gd/fitted_sheet_meaning_in_chinese.pdfIn PDF document text
    • https://bd7a0a6f-bbfd-49cc-ba41-c3f2778102d9.filesusr.com/ugd/9ea91e_be2f32b4719047708d567ca41d7d1841.pdf?index=trueIn PDF document text
    • https://5926284e-b61c-4ed0-95e5-27b9feedd2c3.filesusr.com/ugd/50c35f_c105694f6b4d40a6beb73ef53a92f929.pdf?index=trueIn PDF document text
    • http://kemexulirejaror.rf.gd/tovofimop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e262323f-0d0a-4860-97ec-0fc03c07fe0d/53395190264.pdfIn PDF document text
    • https://92e0cadd-ca3c-497d-ba7d-1aece6ee6da0.filesusr.com/ugd/008e52_7c4d95533b0947788bc31f5c753df8b8.pdf?index=trueIn PDF document text
    • http://vovojoj.atwebpages.com/78379332734.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/13790a2e-36eb-444e-a3ff-dd309f733704/33424524035.pdfIn PDF document text
    • http://limoxukuk.atwebpages.com/american_gods_season_1_episode_3_synopsis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5c74c67-f2d0-4ebc-8527-95896b863885/simple_chocolate_birthday_cake_decoration.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2AC 5088 bytes
SHA-256: 6b5da54eb3b2a639d714b619cb427f5a7a08db87a39f316aba59bbf174f08e1d
font_01_sfnt_off0000f3e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3E2 10660 bytes
SHA-256: fa980294070c43d99bce2e6c2303c6711bd33418feadca53494580c40ec64b13

Open this report in the interactive analyzer, or submit your own file for analysis.