Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e1c536f1280479f…

MALICIOUS

PDF

72.3 KB Created: 2021-03-22 19:44:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 0b5b3d4901af05035a78d646a43772de SHA-1: 9b8dfcc92d304b5ca1ea4581dbeae7d52d094e0e SHA-256: 3e1c536f1280479fea762b41433c171fc0bd97af92dde26c641d23f36df2defc
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file is detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, many of which point to disposable hosting or link farms, suggesting a distribution mechanism for malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically flags the PDF's structure as a link farm on disposable hosting, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=possessive+pronouns+worksheet+grade+6+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4486346/normal_60108f233bc4b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379491/normal_6055f54d5dada.pdfIn PDF document text
    • https://liletizotefos.weebly.com/uploads/1/3/4/2/134234842/5545006.pdfIn PDF document text
    • http://bokugoso.22web.org/finelirurevuxojazij.pdfIn PDF document text
    • http://duvotikuvazax.22web.org/a_writers_reference_9th_edition_mla_citation.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465006/normal_5fd14533c487c.pdfIn PDF document text
    • https://rolorizumi.weebly.com/uploads/1/3/4/3/134316308/palexij.pdfIn PDF document text
    • http://kuxogajow.iblogger.org/rixuwowegivuf.pdfIn PDF document text
    • https://dagigofeno.weebly.com/uploads/1/3/4/8/134887245/e1059e7.pdfIn PDF document text
    • https://biravozoso.weebly.com/uploads/1/3/4/4/134400929/917549eed8c9b3a.pdfIn PDF document text
    • https://bakijunida.weebly.com/uploads/1/3/2/6/132695635/5869612.pdfIn PDF document text
    • https://rexekimat.weebly.com/uploads/1/3/4/0/134017736/ximeroxupefibomot.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404488/normal_602894d66d532.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379970/normal_60318248a00b9.pdfIn PDF document text
    • https://nigukaxo.weebly.com/uploads/1/3/1/4/131453065/2686432.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2526b69d-cabb-47de-a67a-593a9f6a19d1/vebupifovepobowunuluzug.pdfIn PDF document text
    • http://xuziruwunev.rf.gd/word_problems_on_speed_velocity_and_acceleration.pdfIn PDF document text
    • http://bovofekigigewij.rf.gd/10575611169.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12d9805a-d2d4-4e1f-8f3f-467f36a40515/84737829137.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/257a5df6-0ea6-4419-a14a-5f5a8d271ac3/4th_grade_math_test_prep_worksheets.pdfIn PDF document text
    • http://verepipu.epizy.com/xepapus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73a3fd4f-860d-4eff-b614-aefd0b3d9046/probability_random_variables_and_stochastic_processes_fourth_edition.pdfIn PDF document text
    • http://kokutefuto.epizy.com/donald_mclean_automatic_flight_control_systems.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDBC6 5644 bytes
SHA-256: cb5d1d691524e2ac17ecd95bdf91c18a854e86b858db3a7ab970d61e5758989a
font_01_sfnt_off0000ef15.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF15 10780 bytes
SHA-256: 49dd8be15ade46a2d45dafe24d959431549c8f77b43d09baf767194e5b06e2db

Open this report in the interactive analyzer, or submit your own file for analysis.