Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a2d0f4454a378f0…

MALICIOUS

PDF

78.6 KB Created: 2021-03-22 10:51:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: e3721752ff5617426d4aac01d5ed7783 SHA-1: be86ac33a937fe4aa317dcd1b6f23e4aea0a7c87 SHA-256: 4a2d0f4454a378f068bcb7287495bdee4430fe5441cec8d28524b237733d6d93
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a link to a known malicious redirector, indicating a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains text related to "fiu summer 2020 courses", likely a lure to entice users to click the malicious link. The presence of embedded URLs and the ML classifier's high confidence score further support the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=fiu+summer+2020+courses In PDF document text
    • http://sivolejujivozul.scienceontheweb.net/bible_study_topics_tagalog.pdfIn PDF document text
    • http://zetumitufam.mywebcommunity.org/ncert_class_12_biology_textbook.pdfIn PDF document text
    • http://gewusoluxul.scienceontheweb.net/history_of_afghanistan_war.pdfIn PDF document text
    • http://mofirixubutibi.getenjoyment.net/bloomberg_markets_magazine.pdfIn PDF document text
    • http://pezejij.mygamesonline.org/pediatric_asthma_guidelines_2020.pdfIn PDF document text
    • http://bomepufibawil.scienceontheweb.net/quicken_mondo_patch_2015_download.pdfIn PDF document text
    • http://ravevuzovije.mywebcommunity.org/vomedezubatedalutulitaz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://edb7bb8d-792a-4213-93ec-7f573d37cc74.filesusr.com/ugd/bfd504_58cab09561474684bbba46e88f7fe790.pdf?index=trueIn PDF document text
    • http://jabodegodonirad.atwebpages.com/94370728829.pdfIn PDF document text
    • https://307a23dc-bb60-4906-9a68-69e45957aa19.filesusr.com/ugd/d2057d_ce617749e5b545e9ba40a38a653c2e0b.pdf?index=trueIn PDF document text
    • http://zagusax.rf.gd/nulilitu.pdfIn PDF document text
    • https://1a9cd40a-f0d6-44d4-a143-19288280ca2b.filesusr.com/ugd/7a13df_5b83db3d98ea49b5adbc2f424917bdfe.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bulalowisu/debusomavofipoxinililax.pdfIn PDF document text
    • https://s3.amazonaws.com/lemefofutomapox/calendar_2019_november.pdfIn PDF document text
    • http://nakeviw.myartsonline.com/2220340136.pdfIn PDF document text
    • https://e8ceee85-86bf-4804-80ab-d7a1511cbcf5.filesusr.com/ugd/38650a_f9a4ea45ac3248abb6911138da5a4b1f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/figugipopar/indian_babu_movie_300mb.pdfIn PDF document text
    • https://dc58184e-bbba-402a-8e08-a55d552c8f3f.filesusr.com/ugd/0ebc1f_00e692a695ca40218b1c037e1454e0fb.pdf?index=trueIn PDF document text
    • https://6f2fb29c-15f2-4b08-b525-3eb91a7f0a41.filesusr.com/ugd/c3548c_eaf96b9deb514fcc866196aae3f5ed04.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/popilo/malegarikenelonovebir.pdfIn PDF document text
    • https://7c3dd69e-6649-485e-b385-36acc2971cd6.filesusr.com/ugd/cf9ff1_10bebf0b481046709d28da0ee88e9993.pdf?index=trueIn PDF document text
    • http://xakizilixoz.epizy.com/xowekodosibotipumediwe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f61b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF61B 4932 bytes
SHA-256: dd488ffa3576689b4059cf1e5bcb1bd512fa93a60211a5aee9f2a987d7385781
font_01_sfnt_off000106d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106D1 11184 bytes
SHA-256: 5e0205f24ddcb6dc7f8a60af0bfd6202fde4cce1889168e6736f490222d418b8

Open this report in the interactive analyzer, or submit your own file for analysis.