Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f42e9eaa6b81856…

MALICIOUS

PDF

90.4 KB Created: 2021-07-23 16:02:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-08-25
MD5: 0d90f9defd0801b67fe32dfba61b1559 SHA-1: 073a588d5987aef505912ca6ea6063c961002ae1 SHA-256: 4f42e9eaa6b8185625151dfb93a40e42a61fa3b0d081449aa8196a8d8aa3ee56
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a high-severity heuristic indicating it's a redirector link for phishing, pointing to the URL 'https://synerhu.ru/square?utm_term=problemas+de+sumas+restas+multiplicaciones+y+divisiones+para+cuarto+grado'. ClamAV also detected this file as 'Pdf.Phishing.Trojan'. The ML classifier strongly flagged it as malicious. No scripts were extracted, but the presence of a redirector URL suggests an attempt to lure users to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/square?utm_term=problemas+de+sumas+restas+multiplicaciones+y+divisiones+para+cuarto+grado PDF link annotation
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60edb7c076150b527e9d6cfd/1626191808366/computer_algorithms_introduction_to_design_and_analysis_sara_baase.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e93d0c5ebba154a8fd2acf/1625898252971/pvp_arms_talents.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f1348569d2312025745009/1626420357346/java_certification_books_free_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e778691643e268622dc4b3/1625782377942/85962720.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60fa3f561fd7b13c6dbf7eff/1627012951062/10331107925.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60fa9aa0a0113022b24f40df/1627036321089/wifi_not_showing_up_on_laptop.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8f76a0a287971af9845f5/1625880426649/book_chapter_summary_example.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e7b1cb7be683581ce07e61/1625797067129/vizadutevax.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f2757181f38b20587da4fa/1626502513602/uncle_in_christmas_vacation_movie.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ec8b514a8bde38c345b32a/1626114897283/simojilatibifisimuf.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f51268731d8c7c6f124e0b/1626673768310/61790059141.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60eddd383be50f2c5dad76c1/1626201401218/chapter_6_geography_class_7.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ee72e7ab0cb8743be7b737/1626239719584/bivimubifol.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f740f01be25c0fcc7dbeb2/1626816753114/auto_manual_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f29e90c5d9e6782cd99fdf/1626513040266/kotatiwomi.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60fa22c8c9d06d60d5be9195/1627005640756/runukemipefu.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60fa0fd4d3b2bd58044a801c/1627000788404/78918261534.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e8fc03566ded7d61ab5b26/1625881603701/lexuwuvaponotuwapa.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f466101434f635472ef66d/1626629648973/persona_strikers_request.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60edb7919117a44628c31e90/1626191761993/mumafosejidovofepikavojuk.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f81627eed4b367444b2dc5/1626871335311/tinakudoxinugezesakugikar.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ec906a934d360eb28949cf/1626116202399/types_of_gastric_ulcers.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e7c48c1873c46ac938690e/1625801868675/vexafutofuno.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e8c9f3e1e3555a32468f1f/1625868787082/side_bangs_for_round_face.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec96b41cff58014d5568b1/1626117813062/death_note_relight_1.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbf9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBF9 17392 bytes
SHA-256: 6dc11137b0dd50596a5a6aac67556d90ac8ab9bf436e7768d9aa10ee14552af4
font_01_sfnt_off0001274e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1274E 11276 bytes
SHA-256: 20fa5dcf4d36bf7524c85bafefcfbf89767d9f07a3293dbc297b665d2c7bab7b
font_02_sfnt_off00014162.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14162 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.