Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d7fd773dc792fba…

MALICIOUS

PDF

86.6 KB Created: 2021-03-14 21:50:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: b8a3bd26b8f38b3834da81814a91d47e SHA-1: aaf6478ff9d95dd36b6af6f57a637ef6420188b7 SHA-256: 4d7fd773dc792fbad7ae0cba09a59b7bfe20673fe1b4de08c63e76bcbcebe847
174 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains embedded links and heuristic detections indicating it is a link farm designed to redirect users to malicious sites, as evidenced by the 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'ML_NYX_PDF_MALICIOUS' firings. The document body's mention of 'calculated field access form' and the 'SE_INVOICE_LURE' heuristic suggest a phishing pretext. The presence of external URIs and the 'SE_LOLBIN_RUN_COMMAND' heuristic, which mentions powershell commands, indicate the potential for further exploitation or payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/123?utm_term=calculated+field+access+form PDF link annotation
    • http://fitdieta.com/19345552791m3eq6.pdfIn PDF document text
    • http://tozofuji.scienceontheweb.net/piroxoxalukinelabasofu.pdfIn PDF document text
    • http://zdorovie-vashe-vse.xyz/legendary_weapons_gw2_crafting_guide1c4tt.pdfIn PDF document text
    • http://xofitazuregokud.mywebcommunity.org/vidigikopaxekefuberu.pdfIn PDF document text
    • http://pagebake.com/kobidotalomaxaxezutosanf3u6.pdfIn PDF document text
    • http://mbfsopg.com/dedofagetizikuguc9z.pdfIn PDF document text
    • http://vifubavawet.mygamesonline.org/when_was_maya_angelou_poem_phenomenal_woman_written.pdfIn PDF document text
    • http://xomutojekes.myartsonline.cIn macro / runtime command snippet
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/14995830851.pdfIn PDF document text
    • http://robopawize.epizy.com/coloring_sheets_kindergarten_halloween.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d660b3a1-2b4c-4e9a-a665-822dcb4482ca/what_is_el_pollo_loco_chickenless_pollo.pdfIn PDF document text
    • http://punazujekir.epizy.com/fluid_dynamics_and_mechanics_difference.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3daf52e-4645-468e-a9e3-41028f5046fb/80111624662.pdfIn PDF document text
    • https://s3.amazonaws.com/nuvukivaxiren/centimetros_cuadrados_a_pulgadas_cuadradas.pdfIn PDF document text
    • http://jomabav.epizy.com/passport_renewal_application_form_us.pdfIn PDF document text
    • https://s3.amazonaws.com/xonobijikivo/tevet.pdfIn PDF document text
    • http://daforewepon.epizy.com/16058708822.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb96a21b-e7b4-48b3-a87b-7ad21fecf547/python_programming_language_for_beginners.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f61fe56c-6135-4f6f-8138-0d280f4121c5/windows_powershell_commands_ls.pdfIn PDF document text
    • http://xomutojekes.myartsonline.com/craftsman_7_1_4_circular_saw_parts_diagram.pdfIn PDF document text
    • http://depeguriwolanir.rf.gd/lowrance_elite_4x_chirp_ice_transducer.pdfIn macro / runtime command snippet
    • https://uploads.strikinglycdn.com/files/868e746f-9801-4e17-b02f-26767827cf58/2013_dodge_avenger_se_fwd_review.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001072c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1072C 4968 bytes
SHA-256: e81e5d5a92a0da1cd1d14f1c758df2ed358f1d6f5c70d4838b32c388ccddbf9d
font_01_sfnt_off00011811.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11811 11476 bytes
SHA-256: 4a0959bd45c24861cb08d87798f3979fd6599c148f3c0fff1d77503dec868272
font_02_sfnt_off00013f4a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F4A 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.