Malicious PDF — malware analysis report

Static analysis result for SHA-256 456e48f377a6d6aa…

MALICIOUS

PDF

70.1 KB Created: 2021-10-03 00:03:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: e12294811a847af0e39a75bac64fd3c1 SHA-1: 441ac7efecb127603172c7a6ef41c653a0288bae SHA-256: 456e48f377a6d6aa2aca0b22d59dd4f24c000ca7dc9780d0f7e20d1c42b129ff
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=mother+daughter+captions+for+instagram
    • https://101doctor.com/uploads/ckfiles/files/614d40d0c6be8.pdf
    • https://harshahometutors.com/uniformkontakt/userfiles/image/files/gofisaparigolisepiwuked.pdf
    • http://asirius.su/wp-content/plugins/super-forms/uploads/php/files/53b79c54879d7e0ec04baefa5aee3690/nukepijajanikasit.pdf
    • http://anaminfo.com/attachfile/file/93966444167.pdf
    • http://sushrutproctology.org/ckfinder/userfiles/files/xibeliziguxomadename.pdf
    • http://daphongthuyhueminh.com/uploads/image/files/vobizivanawowagetagebapa.pdf
    • http://lsbwg.com/ckfinder/userfiles/files/20210905/050639404.pdf
    • http://webcertain.net/contentupload/fckeditorUploads/organization_/file/77340163899.pdf
    • http://www.texaco.bargiel.com.pl/ckfinder/userfiles/files/xujodomiwi.pdf
    • http://colorsoftexas.com/ckfinder/userfiles/uploads/vewukepavavava.pdf
    • https://sjaindonesia.com/sitefiles/file/32196127482.pdf
    • http://hotstamping.pl/files/file/15548311507.pdf
    • http://findusafranchise.com/files/files/winonarovugozifukib.pdf
    • https://marcvandewiele.com/userfiles/file/56024997202.pdf
    • https://majubesar.net/contents/files/fiworugojekikizusexex.pdf
    • https://gulfcans.com/home/madarmun/public_html/gulfcans/images/bulk_images/files/pajulo.pdf
    • https://abicecream.ru/ckfinder/userfiles/files/69777030705.pdf
    • http://n2nlah.org/UserFiles/file/20440915812.pdf
    • http://eichler-kammerer.de/zululonanup.pdf
    • http://foto-recepty.sk/images/fotky/mewivapifadaxar.pdf
    • http://csc-vietnam.vn/uploads/userfiles/file/21094758831.pdf
    • https://euroquimicadistribucion.com/zabaleta/data/imagenes_contenidos/file/sejeligozogusanekezu.pdf
    • https://dortmundpools.com/contents/files/45849638150.pdf
    • https://szabobuszrendeles.hu/files/files/lipufeniku.pdf
    • http://adanateknikservis.web.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1614dc4a73e4b0---mirogexil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b409.bin
0a0ebcdc222646a5ee667a88a43ab7798c9171ac8a28135d49662312ee3086bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB409 11112 bytes
font_01_sfnt_off0000cd97.bin
6721339679d75fc8d6958e677e502b03b408e6165a2c40c8f89a09aede4db5a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD97 14612 bytes
font_02_sfnt_off0000f20d.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF20D 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.