Malicious PDF — malware analysis report

Static analysis result for SHA-256 572dad4977751258…

MALICIOUS

PDF

113.6 KB Created: 2021-04-03 23:26:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f97c1d15e05ce346043bb2c3fa3c5d28 SHA-1: 86986a7c2eed80df6c342e0a011976238f206ca3 SHA-256: 572dad4977751258b5ac73de9fa06c7c0e419335b9169bdf8c6427e27bba423c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document is identified as malicious by ML classifiers and ClamAV, and it contains numerous embedded URLs. The document body, though heavily obfuscated, suggests a lure related to a 'Yamaha banshee manual pdf'. The presence of multiple external URIs, many hosted on disposable domains, indicates a phishing or redirection attempt to deliver a malicious payload. The primary attack vector appears to be spearphishing attachment, with the PDF itself acting as the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=yamaha+banshee+manual+pdf
    • http://veruvipavopa.getenjoyment.net/what_sith_are_canon.pdf
    • http://sabovibin.medianewsonline.com/86656792188.pdf
    • http://rawoxaxevog.mygamesonline.org/mathematics_books_for_class_12.pdf
    • http://pexulisinipev.sportsontheweb.net/39234029822.pdf
    • http://vuvajujuli.mygamesonline.org/how_to_display_data_in_react.pdf
    • http://gokawojop.scienceontheweb.net/zuwakubopa.pdf
    • http://sinoxaju.mygamesonline.org/graphical_user_interface_design_principles.pdf
    • http://sugakibabusu.scienceontheweb.net/86455721258.pdf
    • http://mibikazut.mypressonline.com/rezofisifosowiwofobu.pdf
    • http://gagigijaloj.22web.org/3524972119.pdf
    • http://gejedesoni.getenjoyment.net/belt_conveyor_power_calculation.pdf
    • http://vijepuwobewi.mygamesonline.org/87913176162.pdf
    • http://vobafoselalulor.mypressonline.com/administrao_de_medicamentos_via_parenteral.pdf
    • http://zapitexidij.mypressonline.com/boxing_drills.pdf
    • http://tokiridevifo.medianewsonline.com/persuasive_writing_examples_year_7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://45f91bdd-2b68-4e60-ae2c-b14373ae5332.filesusr.com/ugd/0d089b_99f050f17d164dc586b5a1f7bf3f2d5f.pdf?index=true
    • http://zimemotom.rf.gd/lanenofudebabiketiriji.pdf
    • https://e108c0fa-8e70-4110-aab7-e0d30777705f.filesusr.com/ugd/d9966b_e0e074d31c3d4b45940e18f2c435a4ce.pdf?index=true
    • http://paxomutu.rf.gd/jumiledoxovibapi.pdf
    • http://wufagezigedo.onlinewebshop.net/zofanazotokapaje.pdf
    • https://49884795-3b66-401c-adaf-b59e999553af.filesusr.com/ugd/8bd6c9_2de045f7dcae435185d8a8b0e9f40534.pdf?index=true
    • https://3175e58c-9db9-4d87-bcb9-15e03531d93d.filesusr.com/ugd/c93210_eef7ee925cfb4782960ad3463c2475c0.pdf?index=true
    • http://magegefopo.atwebpages.com/10_bipartite_settlement_for_clerk.pdf
    • http://xolemobubusosi.rf.gd/angry_birds_1_pc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017ddc.bin
9226ab3aa713e53c68bd5fab8e4c6b25a7b6b9356ce777223ac8b3ed3fd2063b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17DDC 5284 bytes
font_01_sfnt_off00018fa9.bin
ec4b2135e27386eca6a56860aadf49713595379ff3697168587d3dd09495642a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18FA9 11860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.