Malicious PDF — malware analysis report

Static analysis result for SHA-256 52a4fa0c9078d4ae…

MALICIOUS

PDF

102.5 KB Created: 2021-03-27 12:13:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 55875bb404dc07f526a4079762d62223 SHA-1: bc14c4533281f42529afbca5be9764755e542e6f SHA-256: 52a4fa0c9078d4aebb2f04802b32f6886f407a6f77f852ed0789ebd52546bb6b
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document employs an advance-fee scam lure, attempting to trick users with promises of prizes or funds and requiring parcel delivery information. It contains numerous external links, with one prominent URL pointing to a suspicious domain, likely serving as the primary lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=god%2527s+plan+for+marriage+catholic
    • http://heleogose.online/how_to_change_hydraulic_oil_on_scag_turf_tigera5vb7.pdf
    • http://shtangye.xyz/is_calculus_1_differential_or_integralyvpow.pdf
    • http://wijuviniwak.iblogger.org/vavopipubipokige.pdf
    • http://vipiwizazuvuj.22web.org/navonag.pdf
    • http://fruit-citrus.space/stickman_rope_hero_2_appa4i7c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://33da92c3-26de-4f6b-bf12-1693cb6a6e79.filesusr.com/ugd/0307f2_7ebde3f337304e90b7e0737b86675437.pdf?index=true
    • http://lefabeku.epizy.com/7774798279.pdf
    • https://4db61c00-1078-4917-8a1c-a2c1480eb6e0.filesusr.com/ugd/c94206_84e803b341674f46a1f71d7e3ce8349b.pdf?index=true
    • http://ferodibev.onlinewebshop.net/critical_thinking_and_reflective_practice_book.pdf
    • https://8d40832c-2e2b-4284-8151-bb35a16d80ac.filesusr.com/ugd/05d014_ccba00739701414da38ecf3b58ced402.pdf?index=true
    • https://uploads.strikinglycdn.com/files/eeb0ec85-20fa-4d7b-af4d-5364177d970a/r-14m_bookshelf_speakers.pdf
    • http://gejevebo.epizy.com/bucks_rewards_mod_apk.pdf
    • https://4cd5eafb-d261-4666-a528-29b55b1676c1.filesusr.com/ugd/8dde66_246a7ca1ce1e4c818dc2c02c212c4a1d.pdf?index=true
    • http://kufekisawisewo.onlinewebshop.net/20840068459.pdf
    • https://aabf49e0-5477-4fd2-8456-a986ef8f2a87.filesusr.com/ugd/9e14ca_4bf5ffdc10ec48c1bc5982bf78da501f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7d333a3e-b5f5-4fdc-b04e-847c3c7b9454/e550i-b2_does_not_power_on.pdf
    • http://ruwozubusa.epizy.com/retadesaxumuwoteg.pdf
    • https://uploads.strikinglycdn.com/files/d039c3eb-0377-4301-8d45-d4469e34cc6a/badekelogi.pdf
    • http://kubowulurarekij.myartsonline.com/thomas_calculus_11th_edition_key_book_free_download.pdf
    • http://katewamopexo.rf.gd/first_day_of_school_chalkboard_sign_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001444d.bin
175310a546e100fcf02d7bdf6e6e85fb62e93c96baf45506f80c07304e9ff9b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1444D 5424 bytes
font_01_sfnt_off0001569b.bin
86eb2936150538fea4e51fea903ecaca0cdf3320cd041c6bbab4742f4bb39aea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1569B 11812 bytes
font_02_sfnt_off00017eb3.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17EB3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.