Malicious PDF — malware analysis report

Static analysis result for SHA-256 5731b6763dad2e83…

MALICIOUS

PDF

104.4 KB Created: 2021-03-02 04:01:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 9193d2062ebe8282bef0e28b2507171d SHA-1: 49c97df6b62a619aa9c2077ce1d8112c5c1532bf SHA-256: 5731b6763dad2e83b49de028d0126f4e81809a93fb04188b128b0c1cd5b56a52
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs pointing to disposable domains, indicative of a link farm designed to redirect users to malicious content. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are commonly used to host malicious content or redirect to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=fervent+pdf+free PDF link annotation
    • http://trokot-shopnew.online/train_sim_world_2020_f40ph_manual3aqga.pdfIn PDF document text
    • http://milano-moda.space/boeing_777-300er_maintenance_manualb3okx.pdfIn PDF document text
    • http://yandex-dostav.ru/how_to_become_a_vet_tech_in_californiap03i3.pdfIn PDF document text
    • http://netewe5.xyz/wekatuda7g5l.pdfIn PDF document text
    • http://domensita.fun/free_twitter_apk_new_versionv15qm.pdfIn PDF document text
    • http://sexafilavu.iblogger.org/pisoxageregivamufoputek.pdfIn PDF document text
    • http://megesodore.iblogger.org/windows_10_version_1903_iso_microsoft.pdfIn PDF document text
    • http://baltika-trans.com/amortization_and_sinking_fundseynu0.pdfIn PDF document text
    • http://klossheff.xyz/how_to_demonstrate_service_excellence5xz83.pdfIn PDF document text
    • http://wuvuzijime.22web.org/brain_image_free.pdfIn PDF document text
    • http://ridunculus.com/the_secrets_to_successful_strategy_execution2jv70.pdfIn PDF document text
    • http://bilabugova.iblogger.org/kibuviv.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392854/normal_5ff80b2183e35.pdfIn PDF document text
    • http://promoocaoameericanas.com/korg_sv-1_73_dimensionss271i.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e640.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE640 7292 bytes
SHA-256: 2289ca48c58ddd7adfd015c8c1bcf35a0e84f0cbf16a5381d5dfcbaa7373ec16
font_01_sfnt_off0000ff2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF2C 4260 bytes
SHA-256: dede73fcd6f411c44b977b44a4215270a2225b7d4de42be410de86dfec71e8fa
font_02_sfnt_off00010da0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DA0 8584 bytes
SHA-256: 1dd4c85596e8f6a7cfadab605984fd2c406501d4f20c225f98d01043550817ca
font_03_sfnt_off000125e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125E6 14436 bytes
SHA-256: c679d2657a3de6cf36946f93042597de9d7ffafaafe4b962f02de199b9933a1a
font_04_sfnt_off00015512.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15512 20756 bytes
SHA-256: 0d19cf761086923737028e94b97f89970dee1ab14ebb705c03b1500dfd2d02f7
font_05_sfnt_off00017738.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17738 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3
font_06_sfnt_off00018539.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18539 3464 bytes
SHA-256: d72228bbfda3277f2734e3d26743999fc5de42a157ca167f123d62a037b34290

Open this report in the interactive analyzer, or submit your own file for analysis.