Malicious PDF — malware analysis report

Static analysis result for SHA-256 4afaf20a98a20fc8…

MALICIOUS

PDF

78.2 KB Created: 2021-04-08 07:09:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 7d4e43e2fad73081aaeac0c8916a4f78 SHA-1: eb0069768577921f443a254a0415c5c02f2b5fff SHA-256: 4afaf20a98a20fc80cfe78de8a065bc02e685ffc2232b193969c95c82552e801
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with one prominent URL leading to a site that appears to be a lure for search engine traffic. The PDF's structure and the presence of external URIs suggest it is designed to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=how+much+is+a+ford+ranger+engine PDF link annotation
    • http://maxist.ru/935018635145394n.pdfIn PDF document text
    • http://bcpzon4segurabetaviabcp.com/78209420077s258c.pdfIn PDF document text
    • https://cdn.sqhk.co/zarifabidit/o98xOJ4/milady_theory_workbook_answers_chapter_3.pdfIn PDF document text
    • http://tradebot.space/modixuvujirasanajuwimqfrir.pdfIn PDF document text
    • https://cdn.sqhk.co/wujamufaw/hh9Y9he/tovuxapusidugapukedaga.pdfIn PDF document text
    • http://xxlmature.site/best_video_editing_app_apkpure645zr.pdfIn PDF document text
    • http://techanomic.com/how_to_do_the_entrelac_knitting_stitch6k8bm.pdfIn PDF document text
    • https://cdn.sqhk.co/xuxinugad/jihgk8w/aga_khan_laboratory_online_reports.pdfIn PDF document text
    • http://aduo5.online/drive_download_not_workingxe2vo.pdfIn PDF document text
    • http://business-open.online/dawavubojenajezezoxifln5z.pdfIn PDF document text
    • http://leoidet.xyz/11889529095zmkv0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7872ea8e-00da-4b85-bc4b-bfa657547ed4/gibupuja.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b43b7087-f295-4b5c-ab3c-0de5270293be/mxq_android_ott_tv_box_amlogic_s805_firmware.pdfIn PDF document text
    • https://s3.amazonaws.com/jepinebawo/48178202087.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/jazuruwezig.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb95b0a6-3373-49d0-8ada-cc799b871bc2/guluzutaxukazogajali.pdfIn PDF document text
    • https://s3.amazonaws.com/libeganot/how_to_apply_3m_strips.pdfIn PDF document text
    • https://s3.amazonaws.com/xokebore/what_skills_are_required_to_be_a_welder.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4474960-82a3-4954-80a3-0fc16cd1b8a1/how_much_do_aircraft_mechanics_make_a_week.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f473.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF473 5456 bytes
SHA-256: a587716ad4fd1bfde354ab97ffa24849ed89d640bbcd1ee0a7b349d374689db8
font_01_sfnt_off000106ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106EE 10704 bytes
SHA-256: 1a5ffd88d62d50e159cec25480bb477d901c6d7708946b5e1ab711a0af2612fc

Open this report in the interactive analyzer, or submit your own file for analysis.