Malicious PDF — malware analysis report

Static analysis result for SHA-256 42e0a1f818126902…

MALICIOUS

PDF

91.5 KB Created: 2021-04-05 10:35:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: b69dee289d498a32eb78d1189d8fd1cd SHA-1: 0c6b2de7a23a876f85b77262f39a5ac53f4f690e SHA-256: 42e0a1f818126902ceb23f881e8f3510169bc73862b143eb9501714585cd8522
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file is detected as a phishing trojan by ClamAV and flagged by an ML classifier. It contains numerous embedded URLs, many of which point to disposable hosting or suspicious domains, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, appears to be a lure related to a job application.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=mku+private+candidate+application+form+2020+pdf PDF link annotation
    • https://cdn.sqhk.co/putizimetiwe/jcmsjiT/letterboxd_pro_free_trial.pdfIn PDF document text
    • http://garantiya62.ru/159466141265mfqk.pdfIn PDF document text
    • http://trellos.fun/67668825336q12wt.pdfIn PDF document text
    • http://motirepefasake.iblogger.org/military_calisthenics_workout.pdfIn PDF document text
    • https://cdn.sqhk.co/ronuwimo/dHESjhN/54549531634.pdfIn PDF document text
    • http://aov.one/lopupejefebenaxunemotne.pdfIn PDF document text
    • http://limons.space/financial_accounting_bcom_1st_year_notes_in_hindi3em8m.pdfIn PDF document text
    • https://cdn.sqhk.co/wunokebewoz/FoMGAia/steam_tables_temperature_and_pressure.pdfIn PDF document text
    • https://cdn.sqhk.co/wadalibituge/1nihAiB/lucky_life_planner.pdfIn PDF document text
    • http://eushopvmn.site/pinorh2j8i.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://df4002df-ed14-466c-b758-10ced248c840.filesusr.com/ugd/3b03e6_f379c9c7afc74791bf999335281395e0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c89be422-6e52-41e3-babc-fce716816b21/fuvojexivixiz.pdfIn PDF document text
    • https://01dc7cc6-b8ed-446e-8cc8-1ad78882ed38.filesusr.com/ugd/e23fbb_e207c9cae82c4f7980ed2453a4977300.pdf?index=trueIn PDF document text
    • http://paviremepofuvu.epizy.com/origin_and_evolution_of_bryophytes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86b7ef01-0525-4f20-9d98-f4e30a79c130/youtube_to_avi_free.pdfIn PDF document text
    • http://wagivuxofoz.rf.gd/14924251385.pdfIn PDF document text
    • http://pebuvigak.rf.gd/tanefevedi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6430d598-7bd3-4d9b-be13-4002bbd5f45c/history_of_catholic_bible_translations.pdfIn PDF document text
    • https://994180ce-385f-4272-9833-4a204a825e0f.filesusr.com/ugd/ec0c41_ae850ff7a2a04c04a2296833790b2c80.pdf?index=trueIn PDF document text
    • http://towixamum.epizy.com/bepuliniximaxasexopes.pdfIn PDF document text
    • http://wuliwopiveti.rf.gd/abrsm_grade_3_theory_book.pdfIn PDF document text
    • https://cf075d60-af7c-4c71-a16c-5c8c125a9bb7.filesusr.com/ugd/cc03df_88048023338249ed849fe5040d157828.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106DE 5408 bytes
SHA-256: 8d89364f5f00b8e4cc8de1fe8a8a7f9516b00485f0f501100a6d77a97c5f9933
font_01_sfnt_off0001193c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1193C 11604 bytes
SHA-256: 500cfbd1b8543f7414fe45e1ab8ffe31a0432a1116d3fbc92e7781a2742e2c72
font_02_sfnt_off000140a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x140A1 16164 bytes
SHA-256: 6e3fbd491d8b71441998836ddca0d0c102716a221ea14f8143929167ad9a79b3
font_03_sfnt_off000155b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x155B6 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.