Malicious PDF — malware analysis report

Static analysis result for SHA-256 40d09dc7c4d43b84…

MALICIOUS

PDF

79.0 KB Created: 2021-05-01 09:35:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c24ede42890eb1291084e5436cb51fd1 SHA-1: 81a656b3c26c8a076a17eb24c3392a0cd0bb7db9 SHA-256: 40d09dc7c4d43b8481829b15935b298c8f2b09abd0969e29e10daca20f3cdcf5
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many of which point to disposable or unknown domains, suggesting a link farm or phishing lure. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' and the ML classifier strongly indicate malicious intent. Although no scripts were explicitly extracted, the presence of external URIs and the overall structure point towards a phishing or malware distribution attempt, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=business+analytics+masters
    • http://dimozakebaba.scienceontheweb.net/kawapul.pdf
    • http://gofadivus.mygamesonline.org/62833743853.pdf
    • http://dvertsoff.ru/fosamomivoldoovn.pdf
    • http://itravelimpressions.com/lasunudewejimz618z.pdf
    • http://biolinkus.me/54954408198wvkl9.pdf
    • http://inglassrus.ru/xedefekoxosepozurowinut7wxxt.pdf
    • http://greyfruit.space/feelings_and_emotions_worksheets_for_kindergartencp2l6.pdf
    • http://olivamebel.com/what_was_the_military_pay_scale_in_1965qmj23.pdf
    • http://promooffer.site/xofujilujewowasinxjdx4.pdf
    • http://tokio-2020.fun/wosomop93f81.pdf
    • http://doniposebuk.iblogger.org/2812531592.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://guseboses.atwebpages.com/20955845395.pdf
    • https://uploads.strikinglycdn.com/files/e1f1a83e-1122-4fea-b9c1-1e7e7d9c5d97/how_to_get_rid_of_poison_ivy_vinegar.pdf
    • https://7f03322d-63d6-449b-a8c2-a80beffeb2b6.filesusr.com/ugd/2994dd_fe916ab08d9e40e49d55baf2e0b5274c.pdf?index=true
    • http://laxizal.epizy.com/emulateur_android_pc_gratuit_francais.pdf
    • https://c18d9829-3add-4afa-bc87-35007fe3998a.filesusr.com/ugd/70c1ec_25eabc1951f842a3b5c2c14e4a8666da.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c38e955f-0659-4143-945a-d7f295a838d4/how_to_start_electronic_repair_shop_appleton.pdf
    • http://nobuxuka.epizy.com/cell_phone_booster_app_for_android.pdf
    • https://a96990da-dd17-4b11-844c-aba2d588d1b6.filesusr.com/ugd/5e5e7b_a08e880290854925b4dca9693b4c0479.pdf?index=true
    • https://4f65703b-d4c0-4c9c-9e30-73c8cc83ec5d.filesusr.com/ugd/54fa57_1e01782bcc6846d9bdec3be87013c449.pdf?index=true
    • https://8acf0fc4-2da8-4686-9788-d7840b5449fc.filesusr.com/ugd/fab691_ea97c15bbd2f4681849caec34dd5f54a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7f6.bin
dcc4c9e59ab630e489cc6f6bcda2413b23fc01ee9818f3f09a5c76a47ff9664e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F6 5096 bytes
font_01_sfnt_off0001093c.bin
160382be29b996b28e9533aef824249eaeb7b1c4641ed9065243d0658692eb74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1093C 10936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.