Malicious PDF — malware analysis report

Static analysis result for SHA-256 4adb32131b0a396b…

MALICIOUS

PDF

104.7 KB Created: 2021-03-31 13:28:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 75eb79d440298dd56595b0f7fd261355 SHA-1: 57cc255e7708e67d1a864a5ad4e5a597b507607b SHA-256: 4adb32131b0a396bf843b6fa0efce424091a8b2366706e3ae0cd704a71139a4b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The presence of numerous embedded URLs, many pointing to disposable domains, suggests a link farm designed to redirect users to potentially malicious sites. While no scripts were explicitly extracted, the PDF structure and URL patterns are consistent with phishing or malware distribution campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=bhagwat+katha+marathi
    • http://pifedalune.medianewsonline.com/81434420669.pdf
    • https://cdn-cms.f-static.net/uploads/4451929/normal_602f7a99be8d2.pdf
    • http://mofirixubutibi.getenjoyment.net/prosedur_bleaching_gigi.pdf
    • http://ledozikatiresev.scienceontheweb.net/kutiwudozuxol.pdf
    • https://cdn-cms.f-static.net/uploads/4425737/normal_604661aa462e6.pdf
    • https://cdn-cms.f-static.net/uploads/4477916/normal_602e01c95cf3b.pdf
    • http://lofajemami.sportsontheweb.net/pudupavepokukoworaten.pdf
    • https://static.s123-cdn-static.com/uploads/4373520/normal_5fc612f84388b.pdf
    • http://jelojutu.sportsontheweb.net/vawiziv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://zukomakiduw.myartsonline.com/ledarexerofelo.pdf
    • http://devutoza.rf.gd/64296532243.pdf
    • http://munejogi.rf.gd/fusubelizevefevofe.pdf
    • https://s3.amazonaws.com/wixanarer/xusofuvegibuzu.pdf
    • http://gojuveri.rf.gd/cctv_definition.pdf
    • https://s3.amazonaws.com/xedewofuretujo/74985594096.pdf
    • https://s3.amazonaws.com/kevava/group_4_answer_key.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001104f.bin
3cde0a06bdb2b9ee90918189586e2a2460164947cf46f9bf9a93451c4fbccac3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1104F 5092 bytes
font_01_sfnt_off0001218b.bin
a7c194c348f4bc26aad06ae1fa1eadf76503a3aca856ff80314c3d87a816eea9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1218B 3720 bytes
font_02_sfnt_off00012ceb.bin
3a793067325aba03b25367164a4e8fd3e5383a7097371064b0885f60d5d15309		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CEB 10696 bytes
font_03_sfnt_off0001514b.bin
915ded0a21c5427866f217bf88fac4fb267c014031909f367fb5df829af85d32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1514B 16224 bytes
font_04_sfnt_off000166ec.bin
ff31254b4d32833263cbf6b3d908fdf91d5de27107b2bbe01560dfd3f481cdc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166EC 15172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.