Malicious PDF — malware analysis report

Static analysis result for SHA-256 3274c3e0bb5ab42a…

MALICIOUS

PDF

78.9 KB Created: 2021-03-21 22:18:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: be1e3a854b45073d30f7b0b54adb66b5 SHA-1: d0794284d30cd9dc36a8fe84fea4ffabf43d39fb SHA-256: 3274c3e0bb5ab42a352522776b1b6b32726161103f80f98453ff6e589f0b8d0e
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as 'Pdf.Phishing.Trojan' and a machine learning model assigned a high probability of maliciousness. The document contains numerous embedded URLs, many of which point to disposable domains or link farms, suggesting a phishing or redirection attempt. The presence of 'utm_term' parameters in some URLs indicates tracking or campaign-related activity, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=ff7+remake+guide+chapter+14 PDF link annotation
    • https://cdn.sqhk.co/juviwonu/1JghQdo/99722422832.pdfIn PDF document text
    • http://vezokikawelin.iblogger.org/griffith_college_application_form.pdfIn PDF document text
    • https://cdn.sqhk.co/nuxegaxujifo/jiE2gfQ/skyrim_dragon_language_dictionary.pdfIn PDF document text
    • http://ropejolun.iblogger.org/pitisofokarogivukedifari.pdfIn PDF document text
    • https://cdn.sqhk.co/rakapuvad/ejhjigu/the_maze_runner_4.pdfIn PDF document text
    • https://cdn.sqhk.co/vuvupewog/iajdOgd/61830073242.pdfIn PDF document text
    • http://movasolusid.iblogger.org/getting_to_yes_2nd.pdfIn PDF document text
    • https://cdn.sqhk.co/nafolekuge/dhb1Ylk/android_radio_car_logo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/31b0f079-b9d9-49ee-b6be-037bb4918dd2/long_island_railroad_montauk_branch_schedule.pdfIn PDF document text
    • https://8271b8e8-1520-4b18-8785-2fafc8cd33e6.filesusr.com/ugd/efc97f_249e9ed94c5748e2810e4ee6a60c9ed2.pdf?index=trueIn PDF document text
    • https://b5c4f4dd-ae1f-4f6a-908c-f463551224e4.filesusr.com/ugd/dafd60_b11a0c267884465dbd14a57bb36c5f84.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ad0e343-5ee3-4a9b-b8e2-23f92f39985e/organizational_culture_and_leadership_fourth_edition.pdfIn PDF document text
    • https://4fd47d7d-96cb-4cdc-943f-55997d715fc9.filesusr.com/ugd/ab3424_2c362897a8af4608a0c34578a6355fea.pdf?index=trueIn PDF document text
    • http://tokeximu.epizy.com/24444638708.pdfIn PDF document text
    • https://d3dd75b0-514a-4dbf-a1f7-973a5b421fb1.filesusr.com/ugd/5b46ec_cba406b9ebc64935a5f31e6474f415f3.pdf?index=trueIn PDF document text
    • https://46c19374-600d-43be-a5f2-d8bf07c6fddf.filesusr.com/ugd/cc94a4_2bd0ab082572415dba9d07312c80d9b8.pdf?index=trueIn PDF document text
    • https://425e2ee7-996f-4c6d-a593-b44a2a39b733.filesusr.com/ugd/bb05c1_a2277f7c34a4460189e8d94557b909d5.pdf?index=trueIn PDF document text
    • https://76f5a3e5-08d8-4581-9975-6c1b933a1845.filesusr.com/ugd/dbbd16_368decdf013940dc91d07d66fc3e4d58.pdf?index=trueIn PDF document text
    • http://kugesiv.epizy.com/39583431969.pdfIn PDF document text
    • http://fobitomiwoga.epizy.com/wozakademulu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ebf0526-ca18-4b8b-a5cb-c87bbb8eb31e/sherlock_holmes_malayalam_books_online.pdfIn PDF document text
    • https://b84c3727-5d5a-4c5d-9d5d-21cac87b3a69.filesusr.com/ugd/fdd6c2_dcdefdaa4c9f4e14bfead15242561f07.pdf?index=trueIn PDF document text
    • http://bimagox.rf.gd/hamlet_act_2_scene_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77ff230e-72e1-4348-af7b-b7169004fe65/rewumutuxamiriroxosagit.pdfIn PDF document text
    • http://vavilonogamet.epizy.com/73369223289.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBCE 2900 bytes
SHA-256: b3dfb2f2c41da7350fc3755141d2fd0ea5796bb125df25fec831093623ff73df
font_01_sfnt_off0000f611.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF611 5596 bytes
SHA-256: 3d04c7e0a70ce5f0168fab42b4e3ed49f34bb953de6733afce9125f33a7364b5
font_02_sfnt_off00010906.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10906 10868 bytes
SHA-256: 6e7e0cc90f25d7cf373dea9dd35e4da54bb636a2efef5999d198c8f4904a327d

Open this report in the interactive analyzer, or submit your own file for analysis.