Malicious PDF — malware analysis report

Static analysis result for SHA-256 5918c1338ff5fd27…

MALICIOUS

PDF

68.0 KB Created: 2021-06-13 12:40:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: ea514ca74351cf78e6986409432009b2 SHA-1: 4542aba1beac9e5929c83c4de144931eeef25de7 SHA-256: 5918c1338ff5fd27610de13c3db4bce627a95e6ced831bbc3bd624a9c29ca525
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified as a phishing/malware lure by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a deceptive pretext related to educational worksheets. The presence of external URIs and the overall heuristic firings indicate an attempt to redirect the user to a malicious site, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9417

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/pbw?utm_term=long+multiplication+worksheets PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4450351/normal_5fcaec90bb404.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444874/normal_60211614e41d2.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4376629/normal_60b1be419cd84.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446930/normal_6042fa379ce76.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388279/normal_60321884ce92a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454821/normal_606de5f7158c0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/794b332c-15db-43e1-a7f2-41dac204af0b/zaromabovuropoludarajapa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6fe1a28f-e644-4340-bbb8-15c9d412e2d5/what_does_bonne_chance_mean_in_german.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92ef5e6e-46ca-4635-a47c-93d64fb4f1ea/40_hp_tiller_handle_outboard_for_sale.pdfIn PDF document text
    • http://wepadigisita.pbworks.com/f/xozogaxagekudabewor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf7777fc-a540-43d1-9935-7ad47ca1587b/63756417202.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/556a26c6-7d21-4531-8f85-514f44ab4182/76623910203.pdfIn PDF document text
    • http://xewubamefa.pbworks.com/w/file/fetch/144678516/45872134332.pdfIn PDF document text
    • http://jajafad.pbworks.com/f/geometria_y_trigonometria_de_baldor_nueva_edicion.pdfIn PDF document text
    • http://bugedavamib.pbworks.com/w/file/fetch/145216794/sarkar_tamil_songs_mp3.pdfIn PDF document text
    • http://kekirow.pbworks.com/f/kakebunowadulome.pdfIn PDF document text
    • http://barumena.pbworks.com/w/file/fetch/144443076/what_is_the_fbi_fitness_test.pdfIn PDF document text
    • http://nerobedevu.pbworks.com/w/file/fetch/144570117/cnc_machine_ebook_free_download.pdfIn PDF document text
    • http://selapiwilapa.pbworks.com/f/19284118922.pdfIn PDF document text
    • http://xivoxibuza.pbworks.com/f/kizizemapetezesupurov.pdfIn PDF document text
    • http://sijomirurefi.pbworks.com/w/file/fetch/145120662/wexufugijugexubo.pdfIn PDF document text
    • http://nosiravuga.pbworks.com/f/lasifosugimemone.pdfIn PDF document text
    • http://xovelezid.pbworks.com/f/power_system_analysis_and_design_4th_edition_solution_manual.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1F8 5444 bytes
SHA-256: ecc1231fed5a1f8786974f519e178b942862350a3aea5bd15f4adda02b4303f4

Open this report in the interactive analyzer, or submit your own file for analysis.