Malicious PDF — malware analysis report

Static analysis result for SHA-256 38c3c5a9c578b7d2…

MALICIOUS

PDF

72.1 KB Created: 2021-03-06 23:48:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: d8d893cda489c7e03c06f998c9283715 SHA-1: 63e469c16b8349ba7787910be496fc190e338c4a SHA-256: 38c3c5a9c578b7d235cc80d4f6a1168813ab55e70c80e114985d5307101f299e
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain ('lozipotod.ru') that is flagged as an external URI. The ML classifier and ClamAV detection strongly indicate maliciousness, classifying it as a phishing or trojan PDF. The presence of multiple links, including one on disposable hosting, suggests a link farm designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7870

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=how+to+write+essay+in+upsc+capf+exam PDF link annotation
    • https://cdn.sqhk.co/kekelivig/gr477ik/marching_band_store.pdfIn PDF document text
    • https://cdn.sqhk.co/towinomer/FPgfjbE/bonopemojujetitaxo.pdfIn PDF document text
    • http://toteganutiv.66ghz.com/what_does_bi-_monthly_report_mean.pdfIn PDF document text
    • https://cdn.sqhk.co/muresogus/TEjjSf6/fruit_master_game_download_uptodown.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369168/normal_602a133f5083e.pdfIn PDF document text
    • https://cdn.sqhk.co/gapebeve/iiVLiek/ar_sandbox_projector_mount.pdfIn PDF document text
    • http://kizidotiz.iblogger.org/losimisu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368488/normal_602d9cae2d933.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450240/normal_5fe75c5885991.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385635/normal_5fdd3304e12b4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388173/normal_6024a78a202e3.pdfIn PDF document text
    • http://wamepiguvoj.iblogger.org/43333894293.pdfIn PDF document text
    • https://cdn.sqhk.co/vujenibolo/NhbjaGv/70210664215.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://susijul.rf.gd/is_oxford_comma_ap_style.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7291e066-a9f2-4255-9d6f-6e756d42a0e2/craftsman_10_table_saw_review.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwuzerijofa/how_many_calories_does_jumping_rope_for_15_minutes_burn.pdfIn PDF document text
    • http://zotawof.rf.gd/tulerutajosex.pdfIn PDF document text
    • http://finabupotokuko.epizy.com/30307004385.pdfIn PDF document text
    • https://s3.amazonaws.com/bejeseja/scattergories_template.pdfIn PDF document text
    • https://s3.amazonaws.com/xipavir/zalitawadabobas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db46ea59-0b4f-4adf-9a00-3664473bd65b/how_to_change_the_primer_bulb_on_a_poulan_chainsaw.pdfIn PDF document text
    • http://rapuwovire.rf.gd/zipapuzodome.pdfIn PDF document text
    • http://lelexuxifu.epizy.com/dixekaxavivukokufiw.pdfIn PDF document text
    • http://vevurikadi.epizy.com/mirelepusosunilubo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c636237-7657-4362-8f59-90c07cfe7c31/13929348332.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b24492ad-41ce-4b6a-a72d-4e702bb12aa7/bonding_basics_covalent_bonds_worksheet_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/845f312c-5a20-4fe0-9b21-ab5a8f59f282/how_to_make_a_book_jacket_for_school_project.pdfIn PDF document text
    • https://s3.amazonaws.com/baposivarabuj/manual_acls_2017_espaol.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e96c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE96C 5352 bytes
SHA-256: 532fc7646a1b1b68bcd364e3c5236ffc957c4c84cb893441e26f0eac632e4f69
font_01_sfnt_off0000fbab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBAB 10600 bytes
SHA-256: 30e77daf95a1a13e4d16553d283197326f7086af7816dd1e56a07cbf70827f83

Open this report in the interactive analyzer, or submit your own file for analysis.