Malicious PDF — malware analysis report

Static analysis result for SHA-256 49623ec0018c9c02…

MALICIOUS

PDF

75.8 KB Created: 2021-03-23 16:53:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: de790692f464b3efca2dfca4e8aea3ab SHA-1: 9d33e0d357163aa04f990b70525cfd0bf187df81 SHA-256: 49623ec0018c9c02ab42ed44b3c5d902c30aa0d17ac2541845e2d43caec0be85
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with one prominent URL pointing to a site offering 'free download pdf' which is a common lure for phishing or malware distribution. The PDF also exhibits characteristics of a link farm on disposable hosting, further suggesting malicious intent. No scripts were extracted, but the presence of external URIs and the overall structure point towards a phishing or content-luring attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=barbara+taylor+bradford+books+free+download+pdf PDF link annotation
    • http://strgb2.ru/tabla_de_derivadasd3m9f.pdfIn PDF document text
    • http://negozio50sconto.info/envy_4500_manuale199y.pdfIn PDF document text
    • http://mestorating.ru/dakvilt_op_basis_van_asbest44ua9.pdfIn PDF document text
    • http://lunagogafoxoj.sportsontheweb.net/weight_training_programme.pdfIn PDF document text
    • http://barajofa.mywebcommunity.org/when_does_high_school_start_2018.pdfIn PDF document text
    • http://plsale.pro/abu_garcia_black_max_baitcast_reel_reviewt9qxp.pdfIn PDF document text
    • http://esagafow.fun/12021963520pubkh.pdfIn PDF document text
    • http://zujadise.scienceontheweb.net/algebra_all_formula_list.pdfIn PDF document text
    • http://zodatowafe.getenjoyment.net/warm_bodies_streaming_sub_ita.pdfIn PDF document text
    • http://xijulefabogi.getenjoyment.net/digi_002_drivers_for_logic_pro_x.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://wulibazosuxib.onlinewebshop.net/denakolusinuluwuxa.pdfIn PDF document text
    • https://0fc0baf9-b884-4fcd-968e-f93c0f938930.filesusr.com/ugd/68ec51_46930ffcb9bb431db5b2c80556084620.pdf?index=trueIn PDF document text
    • https://bf6af823-cb0d-4ee8-9d5b-4f0b1de5ed24.filesusr.com/ugd/9eb187_21f58285feea43efa91cc45bbf35719d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rovikibixu/how_to_assemble_ab_lounge.pdfIn PDF document text
    • http://litabasiker.onlinewebshop.net/architectural_design_with_sketchup_free_download.pdfIn PDF document text
    • http://rorazizaxaf.atwebpages.com/honeywell_thermostat_rth221b_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/zunaduxa/lizubiwid.pdfIn PDF document text
    • https://434dcbc4-7bd9-40fe-99bf-e102daebf961.filesusr.com/ugd/07ef24_ed8f8e6efb1e429abb95c72826d9eb0a.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e738.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE738 5480 bytes
SHA-256: 74e9fd65a5bdc26a5003dda97715a2911c86323db2354370443257668be9fd29
font_01_sfnt_off0000fa04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA04 11156 bytes
SHA-256: 37d5c8aef0b64b4d8457cefacd5ed8fdb19736c54f18fdf70fe676894ae4000e

Open this report in the interactive analyzer, or submit your own file for analysis.