Malicious PDF — malware analysis report

Static analysis result for SHA-256 55f27008fe6570ff…

MALICIOUS

PDF

74.7 KB Created: 2021-01-19 19:45:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d102aa83d5143e1355346af284f820c2 SHA-1: 76b3e4a18df0647ced2f631920374f53e0d92a7a SHA-256: 55f27008fe6570ff815ecf26f7f8306f9542fd4e0275eb11f807e33aceca2f7d
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded links, identified by the PDF_SEO_DISPOSABLE_LINK_FARM heuristic, suggesting a link farm designed to redirect users to potentially malicious sites. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan. The document body, though heavily obfuscated, contains text related to 'Dji mavic pro max sd card size', which may be used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=dji+mavic+pro+max+sd+card+size
    • https://site-1180442.mozfiles.com/files/1180442/blessed_beauty_lounge_hair_salon_denver_co.pdf
    • https://cdn.sqhk.co/mugejufunij/gpifhbk/nerozetoraxane.pdf
    • https://site-1168066.mozfiles.com/files/1168066/koat_tv_7_breaking_news.pdf
    • https://cdn.sqhk.co/silutoge/jbqHje0/gigolojepolefo.pdf
    • https://site-1179315.mozfiles.com/files/1179315/67727314867.pdf
    • https://site-1171990.mozfiles.com/files/1171990/vuneriwixusexokapag.pdf
    • https://site-1178726.mozfiles.com/files/1178726/capitalism_vs_communism_vs_socialism_examples.pdf
    • https://cdn-cms.f-static.net/uploads/4471513/normal_5fe996e4cf6fc.pdf
    • http://fogozuvonuw.66ghz.com/the_yellow_wallpaper_multiple_choice_questions_answers.pdf
    • https://cdn.sqhk.co/sesijisova/PEhfogj/radiohead_creep_meaning.pdf
    • https://site-1251700.mozfiles.com/files/1251700/jupejopolu.pdf
    • https://site-1247006.mozfiles.com/files/1247006/hydraulics_lab_viva_questions_and_answers.pdf
    • https://static.s123-cdn-static.com/uploads/4387811/normal_5fdf0ed55777b.pdf
    • https://site-1177041.mozfiles.com/files/1177041/payment_gateway_integration_android_application.pdf
    • https://static.s123-cdn-static.com/uploads/4476015/normal_60046cef6d461.pdf
    • https://site-1199448.mozfiles.com/files/1199448/beautiful_flowers_pictures_images.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fabodatutowew.epizy.com/bitevosodufufiwisupajuxeg.pdf
    • http://guxudapese.epizy.com/shivaji_the_boss_movie_ringtone.pdf
    • http://fakuzilezozo.epizy.com/3707011001.pdf
    • http://nefigubisi.epizy.com/telugu_new_songs_ringtones_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e666.bin
0c2f4b40f59a0443159bac841a2a7af20018d6610228d086350c4bece0f28bad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE666 5440 bytes
font_01_sfnt_off0000f8e7.bin
d9df63e71b0bb88f3deace05296ec75cfe41a8e2d41938e757749e2cef16dc0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8E7 10824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.