Malicious PDF — malware analysis report

Static analysis result for SHA-256 48baba5c9c8cb823…

MALICIOUS

PDF

85.2 KB Created: 2021-03-29 22:33:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: b7600e1ff321d9c3ffe7bb5eea6b33b5 SHA-1: 23d2681da0a9809870582564e3072ba20ccfc304 SHA-256: 48baba5c9c8cb82313839c6af8a1ffb7fe4b1ea61dd20b7a3c757362322787aa
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a search result for a specific product error, aiming to trick users into clicking it. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for such lures. While no scripts were explicitly extracted, the presence of embedded URLs and the ML classifier's high confidence score suggest a malicious intent, likely for phishing or to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=kenmore+elite+he3+washer+f02+error PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4503387/normal_604d300a129d2.pdfIn PDF document text
    • http://mabay.fun/1286717902437ok2.pdfIn PDF document text
    • http://mantenancie.com/nulofulojazerladq6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460066/normal_6007302329e1a.pdfIn PDF document text
    • http://talkme-news.info/dabivajebovofafowuvefuz4ynu6.pdfIn PDF document text
    • http://secret-empire.ru/24691337920eb4dc.pdfIn PDF document text
    • http://vadozawemowo.iblogger.org/koterud.pdfIn PDF document text
    • http://copyrighytsupport.com/xapezugonituzuwixuxumrmdtu.pdfIn PDF document text
    • http://youtube-subscribes.com/grammar_worksheets_for_university_studentsgp01u.pdfIn PDF document text
    • http://fusizexa.22web.org/riwidex.pdfIn PDF document text
    • http://zunejabilake.22web.org/nemizakewapo.pdfIn PDF document text
    • http://nowtorrentz.com/42251503233765za.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://4fcc26ae-a476-48f2-98aa-cdc5c12f4544.filesusr.com/ugd/32d0e1_b9dd6b7cbbdf4e0dba92e16d5a2bbdb0.pdf?index=trueIn PDF document text
    • http://zidezogopezir.rf.gd/basic_engineering_circuit_analysis_solution_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fbcf0aed-81d5-4234-8b4e-2f71c96d22ad/wakijanodafezeke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0980fcfd-a2c2-4c08-a815-b3adf93b2b04/19540469921.pdfIn PDF document text
    • https://33b7cf8b-1cb2-46d9-9063-17e97cba5e80.filesusr.com/ugd/9edd50_71068a694c314d77a0c38e9951f9876d.pdf?index=trueIn PDF document text
    • http://nomapalugaji.epizy.com/97273455959.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/baff8e83-c503-449b-8905-72d59a5e5a55/54495260591.pdfIn PDF document text
    • https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_25bd09969b9a4ebeb3698d10806aa6d9.pdf?index=trueIn PDF document text
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_5fa3143e477c4e4699843846aecea3a4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/603427df-b3f6-4641-bd9b-ff2c4b0ac5eb/is_6_figures_enough.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001012f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1012F 5292 bytes
SHA-256: b5517fd58eebe615785ba45afec4dbf51bfb323e161118b98ee73621c8790120
font_01_sfnt_off00011309.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11309 11124 bytes
SHA-256: d303dbe0b87cca80ac97f4d12c947507591a127d9067137590b631b234c6d128
font_02_sfnt_off00013944.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13944 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71