Malicious PDF — malware analysis report

Static analysis result for SHA-256 5972adf73c76ed64…

MALICIOUS

PDF

78.8 KB Created: 2021-03-24 02:03:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: a6953d5261eea7bba11a0a659adc3982 SHA-1: 5d7acdca12f80bb73b263487aef20b614fa34d78 SHA-256: 5972adf73c76ed64aa820d74bd8df049695c62fee3585fc40d02cd4e9c6b3009
134 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and multiple external URIs, indicating malicious intent. The ML classifier and ClamAV detection strongly suggest this is a malicious PDF, likely used for phishing or malware distribution. The document body, though corrupted, suggests a lure related to a 'properties of water lab biology answer key' to entice users to click on the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=properties+of+water+lab+biology+answer+key PDF link annotation
    • http://rijebipimaba.getenjoyment.net/blogs_de_libros_2020.pdfIn PDF document text
    • http://constructionhouse.info/8246945112358ayx.pdfIn PDF document text
    • https://cdn.sqhk.co/golemejexeno/giJkfDE/veterinary_radiologist_salary_uk.pdfIn PDF document text
    • http://tasigezagu.scienceontheweb.net/fuzubukepisibepununananej.pdfIn PDF document text
    • http://salonvarna.com/kakumufibegepogaxapunhhi9.pdfIn PDF document text
    • https://cdn.sqhk.co/dixejetafap/NkIaGjg/jusebiralamisidijomitipe.pdfIn PDF document text
    • https://cdn.sqhk.co/kadeposamo/8hfhSP7/kujapitijafije.pdfIn PDF document text
    • http://mastera-saydinga.ru/how_often_can_i_do_the_10_day_green_smoothie_cleansesdten.pdfIn PDF document text
    • http://tuvurebomiworo.scienceontheweb.net/wuworokizoxezu.pdfIn PDF document text
    • http://instacopyrightcenter.com/kawasaki_bayou_250_engine_for_sale1cpo5.pdfIn PDF document text
    • https://cdn.sqhk.co/lexuxeza/p4ibhc0/73343093062.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://bea00909-aa88-4d38-ac88-e56db460b486.filesusr.com/ugd/923104_7186ca8b4b794fb0a7656f7531636b7e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/36322e3e-e198-4d75-bc7f-412bcc667b9c/tubotasag.pdfIn PDF document text
    • https://d0275d90-c5b4-4c72-b581-d0e2b62fc6dd.filesusr.com/ugd/ee54da_dc87195b1e0b45a79634bf5002ac0afc.pdf?index=trueIn PDF document text
    • https://c1cb471f-fc5c-4ef2-b3e1-4d0d0d09d135.filesusr.com/ugd/cc5b41_d149e8d638214103b92adc2eda0e7213.pdf?index=trueIn PDF document text
    • https://cf268418-7549-4780-9cff-e39e61b5276c.filesusr.com/ugd/0b1cf2_c4cad1c5da074690862925db62662e44.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/af0909a9-766f-4959-a150-7dda741c18b3/kogerisikikezuraso.pdfIn PDF document text
    • https://53ee2ee6-42da-4c96-954f-60f726bc8d53.filesusr.com/ugd/de2744_ddaa2d1ae1ff48a7925f741ea61c7099.pdf?index=trueIn PDF document text
    • http://vebagakid.onlinewebshop.net/cat_6e_cable_specifications.pdfIn PDF document text
    • http://wikukodukoja.onlinewebshop.net/who_pays_for_transgender_surgery.pdfIn PDF document text
    • http://pedirite.onlinewebshop.net/poriw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f67e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF67E 5468 bytes
SHA-256: 27159e70dc163d8f7ef0a4dd40803038f280a8f65f7eff1f57a8e4010d6ea4de
font_01_sfnt_off0001093c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1093C 10544 bytes
SHA-256: fb08f35533252e85a4dc8c6ed270e9e422d19c5be0ac01befb2e10173f2f48e7

Open this report in the interactive analyzer, or submit your own file for analysis.