Malicious PDF — malware analysis report

Static analysis result for SHA-256 5097d8b0be7c9ce3…

MALICIOUS

PDF

78.4 KB Created: 2021-04-15 02:41:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: e5ae5bcf0d57d952873ebf7eea4ce62e SHA-1: ebb9e799278c0ce0bd5fbbe56c309927651b1bb8 SHA-256: 5097d8b0be7c9ce3b735bdd3fb3f5fc2575dd2ff825876b4e92da3d15558b842
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV. It contains numerous embedded URLs, including one that appears to be a redirector for a phishing or malware distribution campaign. The document body, though heavily obfuscated, suggests a lure related to technical information, likely to trick users into visiting the malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=what+is+wisp+repeater+mode PDF link annotation
    • http://vivabozuna.iblogger.org/18844283210.pdfIn PDF document text
    • http://misudijawalezom.22web.org/camila_cabello_real_friends_mp4.pdfIn PDF document text
    • http://interbankdigital.com/pathfinder_roleplaying_game_adventurers_guiden1d9u.pdfIn PDF document text
    • http://xoziduso.mypressonline.com/murray_lawn_mower_dealers_uk.pdfIn PDF document text
    • http://uaregroup.com/forty_rules_of_love_book_plot16neh.pdfIn PDF document text
    • http://majovevalaji.sportsontheweb.net/coordinate_geometry_class_10_test.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381340/normal_6004393d9649b.pdfIn PDF document text
    • http://kdghy.online/bizibenakababozebaweaa6sb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414331/normal_60066013c1a06.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369901/normal_603fa64dbe46c.pdfIn PDF document text
    • http://kidupat.getenjoyment.net/soxefofugifepedovipediro.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454988/normal_60403a6771f0d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444622/normal_604ccd993905e.pdfIn PDF document text
    • http://justamorem.com/daily_use_urdu_sentencesabyz0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://natukifuza.atwebpages.com/gilomusizozifupofeviz.pdfIn PDF document text
    • https://a22cca75-cc8f-459c-9eea-628147015b55.filesusr.com/ugd/2f8a36_8f8025a508be48e185c6c8c822fa5344.pdf?index=trueIn PDF document text
    • https://79ab8074-8148-4faa-9219-f6cdfa35bc15.filesusr.com/ugd/99e004_7f892b0fe6f14f0297fc1b9a22768024.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/784973f6-298f-4d0e-a159-4d26dfee95d3/hp_7525_problem_with_printer_or_ink_system.pdfIn PDF document text
    • https://5d3a357a-25b2-4459-9cd8-210b235f7b36.filesusr.com/ugd/45e30f_bb751fe24f41485591c448dbbb1e7efd.pdf?index=trueIn PDF document text
    • https://bc260b4e-efc2-469d-9102-9c7234992d76.filesusr.com/ugd/b1b3ad_2321889b637a4a74a2148d8d7a5e56ce.pdf?index=trueIn PDF document text
    • https://46b09160-81f9-4cb3-9cca-f7b5b0c0229e.filesusr.com/ugd/179cc6_12e5c4fae1d8454499c4283be03afb17.pdf?index=trueIn PDF document text
    • http://sadoboxijowem.myartsonline.com/agriculture_future.pdfIn PDF document text
    • http://lizaxuru.rf.gd/what_is_chemotherapy_for_cancer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d6a225a-21f6-40b7-a4ba-b8c06fca4fec/coveted_meaning_in_annabel_lee.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83744082-9631-4985-b786-1d7b47dabd93/blacks_law_dictionary_appropriate.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db53.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB53 3204 bytes
SHA-256: f8391f6de8bd91181ebaf506b5164f493e99d371cba069b42c9fe2391a6445ec
font_01_sfnt_off0000e6b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6B6 4952 bytes
SHA-256: 03c38e5336966b099b177168bf7abcce26ecb87ecb910901f2e0105ddcd1486b
font_02_sfnt_off0000f7a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7A1 11136 bytes
SHA-256: 26380e6b670786c94f2e4c5420812c56120b1936d57d58096ccd3ec75e0660eb
font_03_sfnt_off00011cfc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CFC 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.