Malicious PDF — malware analysis report

Static analysis result for SHA-256 2fb474f59d4e71a3…

MALICIOUS

PDF

71.5 KB Created: 2021-06-10 11:00:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eaff1bdcc7990ecb20ee5d4ff4057714 SHA-1: a9908ccc58a62e79803e94e6be33f55cbcbe79f1 SHA-256: 2fb474f59d4e71a3d9779b08146c636f9830b19e0a76edb620f570ae704a6f68
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, with one prominent URL pointing to a domain associated with phishing and malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, suggests a lure related to online conversion tools, likely leading to a phishing or malware download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/pbw?utm_term=convert+ocr+to+word+online+free
    • https://static.s123-cdn-static.com/uploads/4414498/normal_60027e1f0d04c.pdf
    • https://static.s123-cdn-static.com/uploads/4391621/normal_5fe16aa45fa53.pdf
    • https://kujepilam.weebly.com/uploads/1/3/5/3/135343620/2919267c70c71.pdf
    • https://kisuwirabavaruz.weebly.com/uploads/1/3/3/9/133999170/f83b059008.pdf
    • https://tusozesazos.weebly.com/uploads/1/3/4/5/134584188/5263e64b948c72.pdf
    • https://xixezowipena.weebly.com/uploads/1/3/5/3/135341666/3988961.pdf
    • https://cdn-cms.f-static.net/uploads/4421042/normal_6018398fbebc0.pdf
    • https://tugagifozige.weebly.com/uploads/1/3/4/2/134265986/913609.pdf
    • https://static.s123-cdn-static.com/uploads/4383571/normal_5fc9790c89b32.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a54cb139-4316-4dba-9081-4e83af3f0dea/dojiva.pdf
    • http://jevibufile.pbworks.com/w/file/fetch/144543156/3613305474.pdf
    • http://zigunef.pbworks.com/w/file/fetch/144644274/16534524384.pdf
    • http://wafijovodek.pbworks.com/f/don_guide_for_12th_tamil.pdf
    • http://runavepekid.pbworks.com/f/download_sarkodie_rap_attack_instrumental.pdf
    • https://uploads.strikinglycdn.com/files/d35cc6bf-86ad-4bba-82a2-649bccbb2919/mofixemedugel.pdf
    • http://sekodegaxex.pbworks.com/w/file/fetch/144508443/when_is_the_next_firefighter_exam_in_chicago.pdf
    • https://uploads.strikinglycdn.com/files/af4cb6e6-4a20-41c6-aeb7-c203c5b6b1bf/simbologia_en_planos_arquitectonicos.pdf
    • http://xuzutoli.pbworks.com/f/talking_tom_gold_run_hack_download_ios.pdf
    • http://gosirata.pbworks.com/w/file/fetch/144443052/what_is_the_importance_of_descriptive_statistics_in_research.pdf
    • https://uploads.strikinglycdn.com/files/4853b6f9-9a20-4577-96e2-1a494735c830/how_to_replace_pull_cord_on_homelite_blower.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc03.bin
2c22f82e6299d2800859a1810e41fe8207e783c4236c58ea0f71e5ba798e760f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC03 4684 bytes
font_01_sfnt_off0000ec16.bin
dadc6934301bdf9e61810a21c5a2039151704ac852215c46bdcb44a903cb6c43		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC16 10696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.