Malicious PDF — malware analysis report

Static analysis result for SHA-256 4026cd6f9f2403f1…

MALICIOUS

PDF

74.7 KB Created: 2021-04-26 13:11:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: e142310b20818007ff25ac93484d6975 SHA-1: 239482329d57e6ec264d7f17b978e8a2cbd56e73 SHA-256: 4026cd6f9f2403f10bf72093fdbcc35c14ceae7f819b51d9dfef9b2465d07c24
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and is flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The document body, though heavily obfuscated, suggests a lure related to fixing a treadmill, which is likely a pretext to encourage clicking the malicious link. The presence of numerous external URIs and link farm indicators further supports a phishing or malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=how+to+fix+a+treadmill+that+won%2527t+turn+on PDF link annotation
    • http://vadosixajobirug.mygamesonline.org/82883938855.pdfIn PDF document text
    • http://kigumelez.medianewsonline.com/6799448822.pdfIn PDF document text
    • https://cdn.sqhk.co/xiteduva/0FgfHig/unicorn_running_shoes_nike_mens.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476566/normal_603a8b2a982fd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374366/normal_6014e6db5b7d0.pdfIn PDF document text
    • https://cdn.sqhk.co/lazujanaziri/dhIihaJ/thief_life_simulator_roblox.pdfIn PDF document text
    • https://cdn.sqhk.co/vipikunowi/LifhaVZ/lucky_balls_bingo_game.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480880/normal_6016fcffd1f4d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://wogekipa.rf.gd/sonabuzabadakejase.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/39934a77-d896-4b9f-8290-9f1705507508/1128549943.pdfIn PDF document text
    • https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_17ab6c83beb74ceda034a3fd37169897.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e537e0b-8533-4867-9a98-211036a8b637/arnold_education_of_a_bodybuilder_review.pdfIn PDF document text
    • http://zonafikepejese.onlinewebshop.net/equidad_social_en_guatemala.pdfIn PDF document text
    • https://c1d61d78-9bae-425c-b347-ee91470fe4f1.filesusr.com/ugd/60933b_4d608ad9f2054636ae32d30db585e480.pdf?index=trueIn PDF document text
    • http://gonuvatujuj.epizy.com/59783829564.pdfIn PDF document text
    • https://0e67983c-e844-40c9-b604-97311ec94efe.filesusr.com/ugd/6e13d9_0207e40f49db48508c2d4042551c14c5.pdf?index=trueIn PDF document text
    • http://kopolug.myartsonline.com/wifebokipozosulopas.pdfIn PDF document text
    • http://wilunimexa.epizy.com/android_tablet_2019_malaysia.pdfIn PDF document text
    • https://d4cba69e-f3c5-4a64-9e40-69ba24924691.filesusr.com/ugd/b73feb_a89b53de054148ad841b3b325d11b373.pdf?index=trueIn PDF document text
    • https://b3079848-b07e-4d89-9244-05dfa5dd91fe.filesusr.com/ugd/3ab5ed_61a6d82079c940358f7c1037f1b81af0.pdf?index=trueIn PDF document text
    • http://peruroz.onlinewebshop.net/sbi_green_card_application_form.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7D1 5124 bytes
SHA-256: f75e0f8a5cc64b24208505e562a7ce29513c32a64f02c67cb2db1d6bc6c89a03
font_01_sfnt_off0000f92e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF92E 10504 bytes
SHA-256: 2dfb69d7e67e663488cd68b78c644e73a01d79b490d67e95c1dcd4c5b0ef4bef

Open this report in the interactive analyzer, or submit your own file for analysis.