Malicious PDF — malware analysis report

Static analysis result for SHA-256 44ca9c297f06f96e…

MALICIOUS

PDF

90.2 KB Created: 2021-03-17 12:56:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 7ed8c13dd37a4ff728573de6ab1cb07c SHA-1: 9eda0dcf6484dc3118bd16925adfb641f570a75d SHA-256: 44ca9c297f06f96e17fa862cb9d695d8506923c6a5e93a246231b8fcff5e755e
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with one critical heuristic indicating it's a malicious redirector. The document body, though heavily obfuscated, contains text related to 'apk for pc', suggesting a lure for potentially unwanted or malicious software. The presence of numerous PDF links, many pointing to external resources, indicates a strategy to direct users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=ocean+of+apk+for+pc In PDF document text
    • http://operationhomeplate.com/fujumunijuvabuvonabumefonjqd4f.pdfIn PDF document text
    • https://cdn.sqhk.co/savageven/Bgjid5R/99127604997.pdfIn PDF document text
    • http://cmbmarketing.agency/kindergarten_coloring_sheets_back_to_schoolpp7c8.pdfIn PDF document text
    • https://cdn.sqhk.co/jadepibake/jbdgikV/zulizagaxivavuromesuvowu.pdfIn PDF document text
    • http://golosa-spasibo.ru/roku_3800x_airplaytt8pm.pdfIn PDF document text
    • http://kvyovk.xyz/bupumenidutifuzokfm.pdfIn PDF document text
    • https://cdn.sqhk.co/numokafas/auBshdH/kevifazaforemegetaf.pdfIn PDF document text
    • https://cdn.sqhk.co/kawaniroti/wiiBPjh/scruff_app_symbols.pdfIn PDF document text
    • https://cdn.sqhk.co/tijaxasazuwi/MhcZigs/android_game_modern_combat_2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jeponowon/calendars_free_templates_printable.pdfIn PDF document text
    • https://41c240d9-b4af-4f88-8fa4-2a41cce3a287.filesusr.com/ugd/01bc73_5bce6bee7377495480c098027b2c4c02.pdf?index=trueIn PDF document text
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_cf1b3df399334ca8bbae220a3f7fe131.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gekixadonuru/fisamupuzof.pdfIn PDF document text
    • https://s3.amazonaws.com/fukepez/10502706874.pdfIn PDF document text
    • https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_023bc0defcb74ecf8490074135b4f67b.pdf?index=trueIn PDF document text
    • https://f200304d-316b-45a9-b05c-680123ec6d1a.filesusr.com/ugd/aad1a2_0fe814adc1ca4180926cbdeb6aba677e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/remuv/what_comes_on_dominos_philly_cheese_steak_pizza.pdfIn PDF document text
    • https://s3.amazonaws.com/vuliwisuwig/95721860179.pdfIn PDF document text
    • https://s3.amazonaws.com/viboxikuz/lazajuv.pdfIn PDF document text
    • https://s3.amazonaws.com/juzowilipi/sejazorujutawer.pdfIn PDF document text
    • https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_a0041e819a6b4b988290b51cc44aa6e3.pdf?index=trueIn PDF document text
    • https://a1c9bafd-2917-4c1b-b79c-a4b44a941470.filesusr.com/ugd/f0f215_0a2d6e5aef2e42f19ef8ed0d7f558456.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pazatuv/asus_maximus_vii_hero_lan_driver.pdfIn PDF document text
    • https://ebd73b9a-b255-48a5-b781-2bd84b483b4c.filesusr.com/ugd/956c05_b40f921657c0481aaaa767b84c70b3e9.pdf?index=trueIn PDF document text
    • https://2e8e3215-33bf-4fe1-bc67-b38dac560527.filesusr.com/ugd/269bb8_13109f47b9d74e54b820fb0b6a1d6427.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE46 4892 bytes
SHA-256: 146e8fb10ef68dc69f418f5ce38b31d15269b026420f47ffb4376f97f711406b
font_01_sfnt_off00010efb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EFB 4088 bytes
SHA-256: ffe93cb093b97547862e206865f67ad777addaaeafd5fa32d8590d7a1fad0c12
font_02_sfnt_off00011eed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EED 11088 bytes
SHA-256: fc5e8a308f3bea4b9f481fe2babacfb65d95e91b086a245639b567abe9401ee5
font_03_sfnt_off000144ae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x144AE 16228 bytes
SHA-256: ae80f918c09b51ba4a13838c6b3d603265344f1b6e4acf11be52dcabfbdd2669

Open this report in the interactive analyzer, or submit your own file for analysis.