Malicious PDF — malware analysis report

Static analysis result for SHA-256 442c1e0e52891ced…

MALICIOUS

PDF

80.4 KB Created: 2021-04-27 11:48:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 6ccfa18800fd6d3bc665c93874cf2383 SHA-1: d005bf59ef981c01636844f508a970c19181b60c SHA-256: 442c1e0e52891cedb53e2a9fc93c5a3122ec28141ab34c3e92a10f3a34c148e8
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains heuristics indicating it is a link farm and has been flagged by ML classifiers and ClamAV as malicious phishing content. The embedded URLs, such as 'https://soxebez.ru/strik?utm_term=contoh+surat+permohonan+pencairan+dana+pensiun', suggest a phishing attempt disguised as a pension fund withdrawal request. The document body, though heavily obfuscated, contains text related to pension fund requests, reinforcing the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=contoh+surat+permohonan+pencairan+dana+pensiun PDF link annotation
    • http://arfesopt.com/sewutixaba4ak2c.pdfIn PDF document text
    • http://on24-system.club/618958105220hgf5.pdfIn PDF document text
    • http://riwozizedilar.mygamesonline.org/lenovo_yoga_500-14ibd_bios_bin_file.pdfIn PDF document text
    • http://hardcreditcheck.info/is_netflix_sustainableuxlqm.pdfIn PDF document text
    • http://mexicotop.xyz/bufikixetajerujelujrc5d5.pdfIn PDF document text
    • http://xufamorazogubov.sportsontheweb.net/cctv_installation_training_in_tamil.pdfIn PDF document text
    • http://redtea.space/ziragirufokupu8siwn.pdfIn PDF document text
    • http://lalat.space/jilanezumufibiwufokuvjxow.pdfIn PDF document text
    • http://jilavixit.medianewsonline.com/ravi_belagere_books.pdfIn PDF document text
    • http://mazafaka69pussy.online/xavolapeloxidalekdjj.pdfIn PDF document text
    • http://mp4.design/potojaxumizodj40nw.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454967/normal_60036d1f374cc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369190/normal_6037421bd2d9c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476590/normal_601fe37fedee6.pdfIn PDF document text
    • http://cosmicgig.com/jigotubejodunokugm6jly.pdfIn PDF document text
    • http://fegivate.medianewsonline.com/25459600928.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365539/normal_6022c63c966ed.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://72858ab8-d36f-4bc2-b208-e5ec56e76d01.filesusr.com/ugd/3a4e0e_6a267dc74e184ec9aec7cde1f558ebe3.pdf?index=trueIn PDF document text
    • https://d4cba69e-f3c5-4a64-9e40-69ba24924691.filesusr.com/ugd/b73feb_36e22bc786ac43e4b82139eb6fa5827d.pdf?index=trueIn PDF document text
    • https://cae2aa39-5014-47ec-b549-0fed73f36d02.filesusr.com/ugd/c8683e_0899618dd9bb45a89b89e22d4e3c4d7b.pdf?index=trueIn PDF document text
    • http://sefokirof.onlinewebshop.net/64933020202.pdfIn PDF document text
    • https://931f52e6-cb68-4a93-8e02-54808d33f8b6.filesusr.com/ugd/6290de_a31d71eeb5e840f28694048be2971a03.pdf?index=trueIn PDF document text
    • http://lobopekogolo.onlinewebshop.net/81056172821.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD76 5184 bytes
SHA-256: a696ec2082312c619d8d61cde9b55c6f5f61a14d039a73ed9e35fbefca0c1b49
font_01_sfnt_off00010ee4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EE4 10120 bytes
SHA-256: b5f7687b2caded42b808c3f2807ec1f5396fdf92676bd30d26ee2f2f2a2d0dc5

Open this report in the interactive analyzer, or submit your own file for analysis.