Malicious PDF — malware analysis report

Static analysis result for SHA-256 5514b2029c461e90…

MALICIOUS

PDF

90.5 KB Created: 2021-03-30 11:56:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0aefe42dda4f8f0e90cc695bc348ccef SHA-1: 179460cf587f2dec3b84fbd32d33072c929bf49c SHA-256: 5514b2029c461e90fc720b8e29050b86765629e47b16644c1c50f9a5803718cf
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan threat. It contains numerous external URIs and is structured as a link farm, suggesting an attempt to redirect users to potentially harmful websites. The document body, though heavily obfuscated, appears to be related to game search terms, likely a lure to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=rimworld+combat+extended+no+ammo PDF link annotation
    • https://nozusetemakofam.weebly.com/uploads/1/3/1/4/131408546/saxixuzuwujus.pdfIn PDF document text
    • https://dipediras.weebly.com/uploads/1/3/0/7/130739778/85f29393a1ff4a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369187/normal_605de01e88c3b.pdfIn PDF document text
    • http://sosiwawivijomo.scienceontheweb.net/un_centimetro_cuantos_milimetros_tiene.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381541/normal_5fdc384180cc2.pdfIn PDF document text
    • http://tapozifokun.mywebcommunity.org/kenmore_elite_he3_washer_error_code_f35.pdfIn PDF document text
    • https://favasonod.weebly.com/uploads/1/3/2/7/132740296/xebevadejoziwejajin.pdfIn PDF document text
    • http://xomatisuxutu.iblogger.org/vepagugekelaxexugugogi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373259/normal_5ffc00ba600a1.pdfIn PDF document text
    • https://xisiwifuroki.weebly.com/uploads/1/3/5/3/135323104/gakoloji.pdfIn PDF document text
    • http://solusaxisabo.scienceontheweb.net/types_of_concrete_batching_plant.pdfIn PDF document text
    • http://naxajogilelog.medianewsonline.com/char_broil_the_big_easy_oil_less_propane_turkey_fryer_recipes.pdfIn PDF document text
    • http://zajilakofudo.scienceontheweb.net/60698234585.pdfIn PDF document text
    • http://pojibuvuj.mygamesonline.org/tedebebijetijomawelipif.pdfIn PDF document text
    • http://niginotan.22web.org/how_to_do_quick_calculations.pdfIn PDF document text
    • http://sikazigazes.mypressonline.com/ncert_books_class_7_english.pdfIn PDF document text
    • http://sopugepibimel.mypressonline.com/62493494029.pdfIn PDF document text
    • http://gixipures.sportsontheweb.net/assembly_programming_tutorial.pdfIn PDF document text
    • http://puxaxaguv.iblogger.org/all_formula_of_mathematics_download.pdfIn PDF document text
    • http://bikomowaxibujoj.medianewsonline.com/guwedijitanoro.pdfIn PDF document text
    • https://lapaluletegole.weebly.com/uploads/1/3/4/6/134679291/ribedixurowulaxiwum.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://guzedero.rf.gd/catlogo_de_claves_de_unidad_de_medida_sat.pdfIn PDF document text
    • http://silapopo.epizy.com/62744377533.pdfIn PDF document text
    • http://pevogikuxupeja.onlinewebshop.net/cuanto_es_50_gr_en_tazas.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011f04.bin
b2eb876c44de85ed26427f4c7993a0685dbbaefd2cfc11b7f924e196a7908550		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F04 5212 bytes
font_01_sfnt_off000130ba.bin
32d890360448193f2c7a82e5de56e1a652c2895f850a15b3c2a75f5a73611d93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x130BA 13368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.