Malicious PDF — malware analysis report

Static analysis result for SHA-256 49a9b5b1bdf4181e…

MALICIOUS

PDF

78.8 KB Created: 2021-03-27 19:05:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: d29c5680544ef2d9d3603acad229a047 SHA-1: a72702aabb4c85b895644c53f78afd1db8763d3e SHA-256: 49a9b5b1bdf4181ec2c68877eb4927ca39e8692ac2ea35a28eaec8c1b2bb95c0
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one specifically referencing a Samsung TV software update, suggesting a phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a malicious document designed to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=why+can%2527t+i+update+my+samsung+smart+tv+software PDF link annotation
    • https://cdn.sqhk.co/wibetaxor/bhjieoS/halloween_party_day_after.pdfIn PDF document text
    • https://givadebar.weebly.com/uploads/1/3/1/4/131437750/xenoxidoles.pdfIn PDF document text
    • https://cdn.sqhk.co/luwesefizi/hjjjnon/hello_chat_download_video.pdfIn PDF document text
    • https://dagigofeno.weebly.com/uploads/1/3/4/8/134887245/dabavanu_kepexujo.pdfIn PDF document text
    • https://donefuvo.weebly.com/uploads/1/3/1/1/131164418/fce27013e1.pdfIn PDF document text
    • https://cdn.sqhk.co/gobisofokox/gjrQehj/zulotipotunalodovuxex.pdfIn PDF document text
    • http://rowexusaje.mypressonline.com/29740295203.pdfIn PDF document text
    • https://cdn.sqhk.co/tepobugu/eO7hbr1/t-_mobile_plans_for_seniors.pdfIn PDF document text
    • http://lulopoboxefon.scienceontheweb.net/13950299281.pdfIn PDF document text
    • http://gebogezu.22web.org/30923862072.pdfIn PDF document text
    • https://cdn.sqhk.co/xudadidi/WwXhhAP/1060212113.pdfIn PDF document text
    • https://tekaxudifen.weebly.com/uploads/1/3/5/9/135992886/4960252.pdfIn PDF document text
    • http://lomirefuw.iblogger.org/wadinikizewonel.pdfIn PDF document text
    • http://fegubel.iblogger.org/blastocystis_hominis.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kekosasokab.epizy.com/open_c_tuning_guitar_chords.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a10dbba-f0eb-4ff6-8e7d-ddf29560d71b/bass_tracker_trailer_parts.pdfIn PDF document text
    • http://vajapojaperusu.myartsonline.com/wedimenefadatijinabolagog.pdfIn PDF document text
    • http://zurabogefu.rf.gd/back_ups_es_750_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7f3c112-2067-4f65-9ee1-0932d620e990/how_can_i_update_my_samsung_j3_software.pdfIn PDF document text
    • http://fijinibegomiba.rf.gd/asterix_and_obelix_books_free.pdfIn PDF document text
    • http://sukidagijonola.rf.gd/languageguide_org_french_vocabulary.pdfIn PDF document text
    • http://xatidewivi.epizy.com/book_to_read.pdfIn PDF document text
    • http://pabudixobo.epizy.com/john_deere_345_for_sale_canada.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f48f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF48F 5840 bytes
SHA-256: ae9e5808fcb272cf78fc0632ac9c8d061e026dd140d0893270e52559f0005704
font_01_sfnt_off00010878.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10878 10820 bytes
SHA-256: 252231ec91215f8a792819b6cee8613346247bcb959cf2d07c8d83a30c479ba7

Open this report in the interactive analyzer, or submit your own file for analysis.