Malicious PDF — malware analysis report

Static analysis result for SHA-256 42f6fb841c276e56…

MALICIOUS

PDF

100.4 KB Created: 2021-04-07 01:00:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 036adedf650a67f64a1425b851d4f45f SHA-1: 3ffab7ce60bb1cb2a13a03b3414504484ca01da1 SHA-256: 42f6fb841c276e565accc5bc44e00f426c03c22cbe1288058449ae7329d36009
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple external URIs, with one prominent URL pointing to a suspicious domain. Heuristics indicate the PDF is a link farm on disposable hosting and uses an urgency lure. The ML classifier and ClamAV detection strongly suggest malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=arcosanti+form+fest PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4485695/normal_603f134718ed5.pdfIn PDF document text
    • http://peludofnor.fun/fast_motorcycle_driver_gameicfzw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426421/normal_60185c184bf40.pdfIn PDF document text
    • http://wekeb.space/tp-link_tl-wr702n_manuale_italianohj3ob.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414166/normal_6013cb7e3a12e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389107/normal_6024088dbdc13.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393632/normal_6064c6585d6bc.pdfIn PDF document text
    • http://casser.xyz/93730948149q30aj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fifelokorosimo.rf.gd/nys_cdl_road_test_points.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6595468b-3b43-4bdf-b1c0-6c89d47b3770/zunegovog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a9fa7a5-ab2b-49a4-a12f-2c191cde4697/sunejanij.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9c1ba6d-bf01-4a94-ac0b-77a86fc2691c/17752015591.pdfIn PDF document text
    • http://sibugisijan.epizy.com/18710125319.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6fd48d5f-4404-4aee-a763-d2d08f8d5355/gepexitigunijowedirujar.pdfIn PDF document text
    • http://bixuxopot.epizy.com/set_theory_lecture_notes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/57a6f973-1b0c-438f-9068-7f646efacdd7/99127371801.pdfIn PDF document text
    • http://dolifusekaxug.epizy.com/morphology_of_flowering_plants_mcq_with_answers.pdfIn PDF document text
    • http://felobiziwikegu.rf.gd/78613260295.pdfIn PDF document text
    • http://lipesomidu.epizy.com/31206752293.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21a4b105-eaf0-4225-996e-57c43375e5ab/faxefuxadoboduvuxojitu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d805b78c-dba5-4a50-bbf6-ff43dd886d1e/zutofamawabizul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e6341ad-53f2-404d-ae69-c1c8215d1064/ibn_kathir_the_beginning_and_the_end.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c5a1c57-30bb-4f18-858b-9ee273f33c24/netimigexisosajirun.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000103af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103AF 4772 bytes
SHA-256: 1f47ac936c8813ed968094b6297960ada76c76a7fee71ff419850cd555668d30
font_01_sfnt_off000113ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113AC 11208 bytes
SHA-256: c43388aa4e40acee0ce3dcd9e8ecda0f5360330d4f10e354b40786cce460066d
font_02_sfnt_off000133c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x133C6 12456 bytes
SHA-256: 650572c4e9b32500325bbbc1fa30fe077b6efac2a93ebb353ded325bd97964e7
font_03_sfnt_off00015e43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15E43 16360 bytes
SHA-256: d9ab577cc175acfbad86d146a089309b07a853e2291b46d812f32a598d8047ef
font_04_sfnt_off0001740d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1740D 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.