Malicious PDF — malware analysis report

Static analysis result for SHA-256 315d0e29d61c5811…

MALICIOUS

PDF

161.2 KB Created: 2021-03-16 07:23:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 47624b4fa337700520014e0995bc0d86 SHA-1: 292568ef4638aa72f77ac2ece2c6318d6e28bbdf SHA-256: 315d0e29d61c5811ee760116a6abdeb3649e2fd0bf33a62b0d69557ab2ca6e99
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, many of which point to disposable domains or are part of a link farm, suggesting an attempt to redirect users to malicious sites. The document body is heavily obfuscated and appears to contain metadata rather than user-facing content, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9953

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/aws?utm_term=acer+aspire+e+15+e5-575g-57d4+specs PDF link annotation
    • https://cdn.sqhk.co/disumuneriva/7Khfae8/bovada_sports_betting_reviews.pdfIn PDF document text
    • http://rowowevu.mypressonline.com/cambiar_tipo_de_archivo_de_audio.pdfIn PDF document text
    • https://cdn.sqhk.co/remowiwa/biaXTjh/subway_surf_world_tour_london_mod_apk.pdfIn PDF document text
    • http://madoxorijegobe.sportsontheweb.net/panurolin.pdfIn PDF document text
    • https://cdn.sqhk.co/risevejuxik/hNiiiaM/fipimixomipu.pdfIn PDF document text
    • https://wosobariwosamu.weebly.com/uploads/1/3/4/3/134372044/sigagevaga-zatomena.pdfIn PDF document text
    • http://contact-git.top/endocrine_society_of_sri_lanka_guidelinese3rly.pdfIn PDF document text
    • https://vigoxanumevu.weebly.com/uploads/1/3/4/4/134466257/ragudejiw_jinebidaxi.pdfIn PDF document text
    • https://nizesuvijeva.weebly.com/uploads/1/3/1/6/131607023/8918604.pdfIn PDF document text
    • http://trokot-online.xyz/kimuximuliwb2p2j.pdfIn PDF document text
    • https://cdn.sqhk.co/nikofilexi/MhehjzL/13383078636.pdfIn PDF document text
    • https://lebidupevi.weebly.com/uploads/1/3/4/3/134319251/fadeserezamabeli.pdfIn PDF document text
    • http://medyayazilimtr.com/men_s_fashion_illustration_templatesxmxmf.pdfIn PDF document text
    • http://ig-copyrightnotice.com/298795156373h75p.pdfIn PDF document text
    • http://taxokijoba.sportsontheweb.net/45759958583.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://1e8c0764-4a0f-46ab-84a2-5f63a8a44928.filesusr.com/ugd/6a0acf_002ad6360acf4b7db863b84d1053832a.pdf?index=trueIn PDF document text
    • https://b23183eb-b2e5-455e-bc25-91fac1efd10f.filesusr.com/ugd/cc14e4_5d35eec61ac44d7787c4ef62c3c926f3.pdf?index=trueIn PDF document text
    • https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_b9e0da37ca5b4d7a8fe3bd5ebd04f78b.pdf?index=trueIn PDF document text
    • https://4bd9ed84-c80b-4837-bb2f-b1353ebfd8aa.filesusr.com/ugd/5a1791_f669200f5dde4b59a4467b2296b82990.pdf?index=trueIn PDF document text
    • http://pelebirepopo.onlinewebshop.net/sesabeboruv.pdfIn PDF document text
    • https://6fd4412c-3e6e-4f21-a9af-8137ffc6c0d9.filesusr.com/ugd/03469c_afbf87e3adf642d4a2735fdc8bee0a8f.pdf?index=trueIn PDF document text
    • https://cd9ed9ec-87d1-42be-9198-0b2de6c1db4d.filesusr.com/ugd/158fb9_ae602bdc1c87482b8395a8a00db84ff8.pdf?index=trueIn PDF document text
    • https://b3a1a1c9-4f8f-4fb8-b7cc-7339030cc889.filesusr.com/ugd/162fe6_77021acdc6744142a07e7eb0b4db9753.pdf?index=trueIn PDF document text
    • https://2c91b947-1dd8-401e-ae91-d595f2f75867.filesusr.com/ugd/0af078_f6b99b2c1d37417c9535e2677ea87db9.pdf?index=trueIn PDF document text
    • https://8ab1a2d5-e5b1-44c5-a28c-e09959565f0d.filesusr.com/ugd/eb712c_961ed27da7d4474b92ea941994e45314.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off000214de.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x214DE 13852 bytes
SHA-256: a948346feaa9ee43954c6cf132e1b73197dd6020836ff31a790153a0efbd8660
font_00_sfnt_off00014965.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14965 61780 bytes
SHA-256: 32be757deb8eabad340c8d04b35b47fa42c8b929abaf6add0023f65a1aae86bf
font_01_sfnt_off000201c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x201C0 5576 bytes
SHA-256: 0d5ad8aafda4e73b79fd66610bf112ecc0f420be44e6261bc0f8e322775e0186
font_03_sfnt_off00023b96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23B96 20920 bytes
SHA-256: 409e3cb18741b4f090882369f6c9bbfa691acdb5da69f45235c1669954bcf141

Open this report in the interactive analyzer, or submit your own file for analysis.