Malicious PDF — malware analysis report

Static analysis result for SHA-256 38324ed82111b1c5…

MALICIOUS

PDF

84.5 KB Created: 2021-05-15 06:08:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 28e7e1ee58c3292a9d91a9213afca252 SHA-1: 21c0d17a4a70f0be41da1ae5ea8c2b9705ab83fa SHA-256: 38324ed82111b1c5c0adef569620c4d861f4f0484c1d60cdf52d9e1b809308b5
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded links, with one specifically pointing to a known malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and the ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to training plans, which is then used to disguise malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=6+week+half+marathon+training+plan+for+beginners In PDF document text
    • http://topdiscount.pro/life_and_death_in_shanghai_book_review9miaz.pdfIn PDF document text
    • http://future-techno.ru/kudebejajujexadavepijtgon.pdfIn PDF document text
    • http://particulier-societegenerale.xyz/technology_stocks_to_buy_indiao907c.pdfIn PDF document text
    • http://erogan-encolumbia.site/xeferuloso9byo6.pdfIn PDF document text
    • http://jarevine.mywebcommunity.org/2163297245.pdfIn PDF document text
    • http://manekobe.22web.org/why_wont_my_hp_photosmart_5520_print_black.pdfIn PDF document text
    • http://bestunew.xyz/cabify_conductor_app_iosg3mby.pdfIn PDF document text
    • http://sfhgfje5df.xyz/les_miserables_broadway_streaminghdr33.pdfIn PDF document text
    • http://naturwows.space/serumexozexa8ri.pdfIn PDF document text
    • http://hookup157.fun/19256358064btyzy.pdfIn PDF document text
    • http://redpandarecycling.com/harman_pellet_stove_dealers_in_marylandlpjxd.pdfIn PDF document text
    • http://tifunadepepix.22web.org/71727371029.pdfIn PDF document text
    • http://idslim-italia.site/74737144668kzxwt.pdfIn PDF document text
    • http://alfa-quest.ru/zorudu68acs.pdfIn PDF document text
    • http://bunnygummy.ru/zuvejebijixisukogibebijfca9.pdfIn PDF document text
    • http://organize.shop/79220688958rmudw.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f4ef19d8-372f-49db-bbb6-0f5e16bfa625.filesusr.com/ugd/070799_3a62ffa16859475eb91bebec63fdc77a.pdf?index=trueIn PDF document text
    • https://694dae7a-2033-4a59-8b06-91ff4eec0774.filesusr.com/ugd/e1d58f_a8bbad46d143497f87089cf7d1d6f79d.pdf?index=trueIn PDF document text
    • http://viwuwijagabote.myartsonline.com/business_communication_and_report_writing_course_outline.pdfIn PDF document text
    • https://2daccc73-8708-4113-a26a-4f38906335d9.filesusr.com/ugd/f65175_5e1ab18073b449c185e6a2a8b9f78fd2.pdf?index=trueIn PDF document text
    • https://438c9214-13ba-44a2-8469-a4c97ff43377.filesusr.com/ugd/5d46a0_60b05e28d6464a2ab8fafdc201f1ccba.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010acb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10ACB 5672 bytes
SHA-256: 023f5d252b8f64728baae9dfe228b5a64ca861dd616d2a2c5152022857c2fc9d
font_01_sfnt_off00011e04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E04 10664 bytes
SHA-256: 3ac5ffb73bddd0166518b703a4c83373533400ebd4bf24a30602b90c244c66fb

Open this report in the interactive analyzer, or submit your own file for analysis.