Malicious PDF — malware analysis report

Static analysis result for SHA-256 45aad86fb729e6a8…

MALICIOUS

PDF

79.2 KB Created: 2021-03-20 13:13:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 419a1e57e4819410e693162ccf7e71fa SHA-1: 891b7a2fad8874c132d6cb4d32724c2abd30f30a SHA-256: 45aad86fb729e6a892a10005a2872b8d4f87d4ff7c87e0d24377600fe563d1bb
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains numerous embedded URLs, many of which point to disposable domains, suggesting a link farm or phishing lure. The document body, though heavily obfuscated, contains references to 'Canadian auditing standards pdf' and 'wkhtmltopdf', likely a deceptive pretext to encourage clicks on the malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=canadian+auditing+standards+pdf PDF link annotation
    • http://goromeo.club/gugabazuxu35fi.pdfIn PDF document text
    • http://ompala.store/diccionario_latin_espaol_sopenabno9w.pdfIn PDF document text
    • http://4338bacchus.com/wajokuxanetalisujejoqeqd6.pdfIn PDF document text
    • http://munupesifak.22web.org/pikenivekolafabifu.pdfIn PDF document text
    • http://volosaty100.xyz/149016254059pjn7.pdfIn PDF document text
    • http://opensol.xyz/dabite8lu2w.pdfIn PDF document text
    • http://tekelas.iblogger.org/france_24_english_tv_guide.pdfIn PDF document text
    • http://arevakar-travel.com/mobility_scooter_repair_near_mem8005.pdfIn PDF document text
    • http://creditactive.info/87001728822kh9a4.pdfIn PDF document text
    • http://yachtcharter.group/80087603834mreql.pdfIn PDF document text
    • http://nuwojukow.mygamesonline.org/advances_in_soil_microbiology.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/652491a2-47b2-401b-acfd-ce6b535a80cf/10169409239.pdfIn PDF document text
    • https://ac614e2c-2e00-43e4-a80f-2c6bce9fb64b.filesusr.com/ugd/f103bb_77bd067472f544609ed2c52fc7d5b77f.pdf?index=trueIn PDF document text
    • http://xegebasitez.rf.gd/51701667075.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6afa66b-e2d1-4c63-a2e0-b0cd8065f96e/how_to_check_rashes_on_babies.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2eb8fa2-708f-4e71-810e-479358842521/what_is_the_actual_story_of_the_birds_and_the_bees.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be77c6d7-ae32-4aaa-be2b-865fdb60f441/twilight_part_2_full_movie_in_hindi_download_480p.pdfIn PDF document text
    • https://1de4b56a-3309-4767-83a2-f1bb1ea7c594.filesusr.com/ugd/a6e5e9_68fec3083c304ddf89075fe1b3404d65.pdf?index=trueIn PDF document text
    • http://sajomapujozokux.onlinewebshop.net/nalovatejosi.pdfIn PDF document text
    • http://bodagoge.epizy.com/honey_hush_fats_waller_sheet_music.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1542342f-8e51-41be-83d1-b59c135a95de/brinks_motion_detector_flood_light.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f981.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF981 5084 bytes
SHA-256: 80af6d5d4ec40fca2ca839256bd5512baaf2a6422343c93b4163145b4364a94e
font_01_sfnt_off00010adc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10ADC 10712 bytes
SHA-256: 1eb0de5ab7371cef6f80ab6065fcd5c43e0bc5567b7b9f593cd053de2c663500

Open this report in the interactive analyzer, or submit your own file for analysis.