Malicious PDF — malware analysis report

Static analysis result for SHA-256 48b88045f2e99077…

MALICIOUS

PDF

77.5 KB Created: 2021-03-28 20:06:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 33dda2d1b012d90cbb7f2b1ddd2cf529 SHA-1: d084ac0c88d6651dce09524a6e7663e041cbf135 SHA-256: 48b88045f2e99077e1af8068565ed54c2eefa57feb40879ad9c8b7dcc0e5d7e1
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, many of which point to disposable hosting or potentially malicious domains, suggesting a link farm or redirection scheme. The document body, though heavily obfuscated, appears to be a lure related to job opportunities, which is a common tactic for phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/aws?utm_term=health+and+safety+jobs+salary+in+dubai PDF link annotation
    • http://ruzoboxilotazex.22web.org/pdp_afterglow_ag_9_manual.pdfIn PDF document text
    • http://ladirojenovezoj.mygamesonline.org/wasemin.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374847/normal_6036a0d0d3eac.pdfIn PDF document text
    • http://blaugrana.ru/chiru_songs_freeudihx.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459463/normal_5fdab3fc763cd.pdfIn PDF document text
    • http://draiwenstore.online/ruwiserimorotasabufvyd4a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://karababeso.rf.gd/que_medios_de_comunicacion_existen_en_internet.pdfIn PDF document text
    • https://b56e00ce-d729-42e9-814b-b9a4b194f5ba.filesusr.com/ugd/f6f93f_0bd0b5668bf547b9a7aa39cc8163e0a5.pdf?index=trueIn PDF document text
    • http://rigemileluzed.epizy.com/dewalt_d55168_air_compressor_manual.pdfIn PDF document text
    • http://lobopekogolo.onlinewebshop.net/11101503573.pdfIn PDF document text
    • https://4c982f7a-b72b-446d-8c7a-5e2d6818c0db.filesusr.com/ugd/519a61_de07ae5b44fe4073ae32354ae3599ae5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fbd2b8b-f717-47e6-9d3d-faa32491d5b6/tp-link_tl-wr841n_v9_manual.pdfIn PDF document text
    • http://vawivulumekil.onlinewebshop.net/75125046658.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/065b1060-f334-4456-ad7f-8e15604fa8f2/11853483367.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a637d3e5-553b-49db-b5cd-84c3e3188b2d/cc3_selected_answers_chapter_8.pdfIn PDF document text
    • http://xefiposokupama.myartsonline.com/94453955059.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f203.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF203 5276 bytes
SHA-256: 0a506ad01a375ba7dcfe516645c1057c0499a467dcad22f3b50772497b9b4602
font_01_sfnt_off000103f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103F0 10936 bytes
SHA-256: 06f179d2a445673715bb326fb67eefeec07189a34dd7df67a57ba25ac288d8a4

Open this report in the interactive analyzer, or submit your own file for analysis.