Malicious PDF — malware analysis report

Static analysis result for SHA-256 519360254c9e2f1a…

MALICIOUS

PDF

96.2 KB Created: 2021-04-03 22:26:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: ae4a6e8d13a9188b0ccb08e5f281e44d SHA-1: 5e1526e1db3cfbf87b025a23d4ea8a03b617fca0 SHA-256: 519360254c9e2f1a2b8e3f6037f7035a029174c4ffca84ba5735b44b9b07bde6
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many pointing to disposable hosting and utilizing UTM parameters, indicating a likely phishing or spam campaign designed to redirect users to malicious sites. No scripts were extracted, but the presence of multiple external URIs and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic strongly suggest a link-farming or phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=anstoss+3+android PDF link annotation
    • http://bajoreto.sportsontheweb.net/performance_appraisal_format.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446017/normal_6060f2ce0e90b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4466161/normal_5fcc76a6d7623.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381094/normal_602dcdd2a5382.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416940/normal_6001cd63717e8.pdfIn PDF document text
    • https://cdn.sqhk.co/gabazumad/hhnujcn/gunblood_western_shootout_cheat_codes.pdfIn PDF document text
    • http://tosefabebiribow.scienceontheweb.net/netgear_wgr614_v7_firmware.pdfIn PDF document text
    • http://jogajep.medianewsonline.com/buchi_emecheta_books.pdfIn PDF document text
    • https://cdn.sqhk.co/lexebogefaj/dSLZsji/lolaxilege.pdfIn PDF document text
    • http://tiriruno.sportsontheweb.net/free_embroidery_stitches.pdfIn PDF document text
    • https://cdn.sqhk.co/guranotup/jcmLEjg/43397895068.pdfIn PDF document text
    • http://tixaman.scienceontheweb.net/grimm_s_fairy_tales_english.pdfIn PDF document text
    • http://ponaxamewimenul.sportsontheweb.net/konisoxaga.pdfIn PDF document text
    • https://cdn.sqhk.co/vapatibu/iehiRie/star_wars_jedi_fallen_order_2020.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://33b7cf8b-1cb2-46d9-9063-17e97cba5e80.filesusr.com/ugd/9edd50_9cfb4fe9d34e42039e029711f12eff97.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jinabom/harry_potter_and_the_philosophers_stone_book_price_in_philippines.pdfIn PDF document text
    • https://s3.amazonaws.com/latufenaw/gipiwilogaxerezax.pdfIn PDF document text
    • https://fb9345b8-40be-4608-a8ff-9c5427dba92f.filesusr.com/ugd/98d639_90444534829444759cd43e1256af1a59.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xuvamuba/improving_vocabulary_worksheets_ks2.pdfIn PDF document text
    • https://e0bfa911-60eb-4c53-bd8d-ceec25156dfb.filesusr.com/ugd/0a052f_1cad2db6b0954d69b0cc27ac6227c7f8.pdf?index=trueIn PDF document text
    • https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_df261415cf07455cabb93343481acd9d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zikeko/leblanc_guide_urf.pdfIn PDF document text
    • https://1df32be7-5e6a-491e-80e4-5c558052ef26.filesusr.com/ugd/e02e08_f56259f4bd3749e1a9a31348f4102918.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000137a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x137A8 4940 bytes
SHA-256: ebc69dc4455404330011699871eb263ca13d3091ab8c47122bf083083ca37c29
font_01_sfnt_off0001487f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1487F 12532 bytes
SHA-256: 79c8dd38eb7e49d15b9e2bd9e1c050a5d242228c23bc1502c46b91bc909e70d7

Open this report in the interactive analyzer, or submit your own file for analysis.