Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a26d53bb490b7a5…

MALICIOUS

PDF

70.1 KB Created: 2021-03-24 10:54:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: f4dab9a569e79bd16757267e2d6a3623 SHA-1: 5d43cd8dac76c829b022b3a5895819d98c39ab72 SHA-256: 4a26d53bb490b7a5a871cc693859fe71154a423a1f3cc882957209f6f8187984
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain associated with a keyword search for a hacked game. Heuristics indicate the PDF is a link farm on disposable hosting, and ClamAV detected it as a phishing trojan. The ML classifier also strongly flagged it as malicious. The document body, though heavily obfuscated, contains references to 'freeway fury 3 hacked unblocked' and 'wkhtmltopdf', suggesting a lure to a potentially compromised game download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=freeway+fury+3+hacked+unblocked PDF link annotation
    • http://rumokerejimo.iblogger.org/tajagozikejewi.pdfIn PDF document text
    • http://duwefazef.22web.org/82337473629.pdfIn PDF document text
    • http://netubekebusis.iblogger.org/wow_enchanting_guide.pdfIn PDF document text
    • http://fivibimotuwar.22web.org/homework_sheet_template_excel.pdfIn PDF document text
    • http://boburokopuxixud.iblogger.org/72678138186.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kevava/naxudoladonaxujewet.pdfIn PDF document text
    • https://434dcbc4-7bd9-40fe-99bf-e102daebf961.filesusr.com/ugd/07ef24_9bc18f0ccaae4113af77cf65af6c963f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nerugiraxura/html_form_file_upload_multiple.pdfIn PDF document text
    • https://874c0fd6-92eb-497b-905f-dc7ca4d2e287.filesusr.com/ugd/5ca7d4_f5f979caf6374418a111f16d09797d0e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lekelepowo/90590367623.pdfIn PDF document text
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_55be4795d3034de788dc4c1bcb557f11.pdf?index=trueIn PDF document text
    • https://35479656-6a94-44d6-ac55-da507c14a2ae.filesusr.com/ugd/d68318_8da8cf69bd9b480ebb278cbd5b967a06.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nefomojuwet/who_is_the_best_character_in_one_piece_treasure_cruise.pdfIn PDF document text
    • http://zixufiwama.rf.gd/22372079782.pdfIn PDF document text
    • http://sukepavudopuje.epizy.com/bedorodurap.pdfIn PDF document text
    • https://1ce8651a-bfbb-4b9a-b1bf-24b3b574775a.filesusr.com/ugd/ac72e0_c92dfa4b9f5f441da07c81c58b1ec20b.pdf?index=trueIn PDF document text
    • http://nojatajof.rf.gd/content_marketing_strategy_plan_template.pdfIn PDF document text
    • https://a3c35cc3-4a3f-4d41-ab51-8b3e4b114d30.filesusr.com/ugd/2b25b5_35dee5182efb486d845bc5856daa5500.pdf?index=trueIn PDF document text
    • http://tojederetesez.epizy.com/states_of_matter_class_11_numericals.pdfIn PDF document text
    • https://113c517c-d7b0-4b36-99d7-6722bcb7ef36.filesusr.com/ugd/8e66a5_cb5f410bbe6646269a7123ef7b89dfcb.pdf?index=trueIn PDF document text
    • http://rilowoxex.rf.gd/bharatiya_vidya_bhavan_books.pdfIn PDF document text
    • https://1b6fe947-be7e-4494-9a94-f566f178d3d1.filesusr.com/ugd/89064d_2f61dd997a9b4479bcf9126722c7e5e7.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d48d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD48D 5448 bytes
SHA-256: 0734cf0569a0caa73c0b90d0771c5e8a887e7c376d739035866b68a14515df66
font_01_sfnt_off0000e72c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE72C 10472 bytes
SHA-256: 69b2a2152f62610964e9b0e566bbb1bbb9f895e177430e044e75859bda4a1bd7

Open this report in the interactive analyzer, or submit your own file for analysis.