Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f875d9c673fcae6…

MALICIOUS

PDF

86.3 KB Created: 2021-09-09 13:50:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 42fe354f42fb3273ccf149b029f4241d SHA-1: 540c86a35796ff81dcf630454995c20fd9eaaa06 SHA-256: 2f875d9c673fcae639d2435a3826045da10ae48149c782263e3413ec8270e922
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and a machine learning classifier. It contains embedded JavaScript, which is often used to download and execute further malicious content. The PDF also exhibits characteristics of a link farm, with numerous external URIs pointing to disposable hosting, suggesting an attempt to distribute or host malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.entornopublicitario.com/wp-content/plugins/super-forms/uploads/php/files/01f633ef145cb3d6fbb0b1275ea5fdda/basufifoj.pdf
    • http://currycornersugarland.com/admin/images/file/96010311003.pdf
    • http://humanlitech.com/files/files/tarurosida.pdf
    • https://vinacoma3.vn/userfiles/file/66679483808.pdf
    • https://ailani.org/wp-content/plugins/super-forms/uploads/php/files/767c1851f630f6b9258e43cc4d55bb2e/telebumete.pdf
    • https://gtselect.fr/ckfinder/userfiles/files/fozegu.pdf
    • http://pnalog.ru/images/file/54431908645.pdf
    • https://zohopinler.com/calisma2/files/uploads/56846683765.pdf
    • http://fsgzb.com/upfolder/e/files/20210908203729.pdf
    • http://bezagsecurity.cz/userfiles/97514761311.pdf
    • http://mevlanaasm.com/resimler/files/depozap.pdf
    • http://kepco-group.com/uploaded_files/userfiles/files/kosuz.pdf
    • https://bruceleevideos.org/images/file/nikaruviko.pdf
    • http://iaestedresden.de/userfiles/file/41935604955.pdf
    • http://huyndaicaudien.com/upload/files/48496829508.pdf
    • http://sunrui-ti.com/d/files/93189583754.pdf
    • https://istruttorecinofilo.it/userfiles/file/vizakinutanopok.pdf
    • https://abcelectricalonlineshop.brilliantwebtech.com/userfiles/files/musosapeguzirunamikila.pdf
    • http://interel-rus.ru/test/sites/default/files/file/62790969547.pdf
    • http://ap116.ru/userfiles/file/volol.pdf
    • https://www.agro-zavod.ru/app/webroot/js/ckfinder/userfiles/files/55313957066.pdf
    • https://cli-kh.com/uploads/files/202109090914521075.pdf
    • https://vanphongphampmc.com/upload/files/32837740045.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=god+of+war+ghost+of+sparta+android+game+free+download
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2d6.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2D6 16792 bytes
font_01_sfnt_off0000faed.bin
fc2a7ff1531324854022595e9f69b5d0e71944efd62304de742b46d6acf2a976		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAED 11068 bytes
font_02_sfnt_off00011468.bin
d70b44554e9279efef075872c72e901a36367259a227fffd61e8ad2b6bbd15c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11468 20864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.