Malicious PDF — malware analysis report

Static analysis result for SHA-256 47b877cf97ff58be…

MALICIOUS

PDF

90.4 KB Created: 2021-04-07 14:54:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6f15666fa16c755e3dbae53d95964c02 SHA-1: 5d603dfa33fb5e3e22b381ab7da44c2bd17c7780 SHA-256: 47b877cf97ff58be552b440217727cb71ee673e2a128365ce9c75f5bc3b8b3fd
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with a prominent one leading to a site offering a movie download, suggesting a lure for malicious content. The PDF structure and embedded links are indicative of a phishing campaign aiming to trick users into downloading malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=andromeda+strain+2008+full+movie+free+download
    • http://ezfix.asia/2231262477tzo2.pdf
    • https://jawizadobem.weebly.com/uploads/1/3/4/7/134773472/0371bdcb.pdf
    • http://kieverts.xyz/toilet_running_water_into_bowl_ukdfngl.pdf
    • http://smartycredit.info/us_history_regents_answers_jan_2018pem0x.pdf
    • http://matcobzor.ru/10927746767n7ffc.pdf
    • https://cdn-cms.f-static.net/uploads/4447433/normal_604146581b7e8.pdf
    • http://fikepoj.22web.org/black_platform_king_bedroom_sets.pdf
    • https://cdn-cms.f-static.net/uploads/4408485/normal_5fe9b912ef96c.pdf
    • https://cdn-cms.f-static.net/uploads/4382197/normal_604d0c4be733d.pdf
    • http://characduwe.space/surukiketidajewidafababn7gua.pdf
    • https://varupeneg.weebly.com/uploads/1/3/0/9/130969993/gexenag.pdf
    • http://naturaitalia.space/sociolinguistics_an_introduction_to_language_and_societyc0qev.pdf
    • http://marketeuro.pro/5925976115nvdqs.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xupumigix.epizy.com/48781887086.pdf
    • http://luremugaxufarup.epizy.com/79188335705.pdf
    • http://pezajedoti.epizy.com/52243582160.pdf
    • https://uploads.strikinglycdn.com/files/6aca130d-5f9c-4c90-9248-45fd21cf7f1f/basic_mechanical_engineering_gtu_book_download.pdf
    • https://uploads.strikinglycdn.com/files/4f369470-e500-4332-b434-f38cb367a2d9/22503760073.pdf
    • https://uploads.strikinglycdn.com/files/74c7d97b-d46d-4099-82c8-482fe463af14/wedat.pdf
    • http://zowuxepalaget.epizy.com/14023111894.pdf
    • https://uploads.strikinglycdn.com/files/521a70c0-a5b3-4f56-bae9-cf6aaf84f7c9/shimano_alfine_hub_8_speed.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000115b0.bin
80087bd6bb97de8e7f210c3ed58c9e84348bf3f1c38550b9089d0ec5c480c5b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115B0 5664 bytes
font_01_sfnt_off000128e2.bin
19d579821e83c32cd478aefcb57f849508ece8625c42f2108810477b29a00d2f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128E2 1936 bytes
font_02_sfnt_off00013228.bin
477e87091730279d540c9f85e15510a38f89a1fdd9075f64433d7ff820bf979a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13228 12268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.