Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a9ae26437186104…

MALICIOUS

PDF

80.4 KB Created: 2021-03-29 18:36:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: c1416b8e90a4fdd6586aa718faa05595 SHA-1: bda6799a754e2f4f76ec1b088bbaf8c104f7c2fe SHA-256: 5a9ae264371861047ad155fbc44c948b5074c1378f0cedc15a4793d3e2a77abf
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that redirects to a suspicious domain, identified as a link farm on disposable hosting. ClamAV detection as 'Pdf.Phishing.Trojan' and ML classification further indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to a book title, likely to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6918

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=alberto+moravia+carti+pdf PDF link annotation
    • https://cdn.sqhk.co/xefilelo/hdjdvji/ramilowusovuve.pdfIn PDF document text
    • http://rixanemusijod.mywebcommunity.org/atlas_copco_air_compressor_ga90_manual.pdfIn PDF document text
    • https://cdn.sqhk.co/genamudazunu/gcaiajg/rodozopoxotolozed.pdfIn PDF document text
    • http://rusadezebep.mygamesonline.org/how_many_chapters_are_in_chronicle_of_a_death_foretold.pdfIn PDF document text
    • https://cdn.sqhk.co/wexovezojab/ghijYgg/3d_surround_music_player_apk_free_download.pdfIn PDF document text
    • http://vopagokiniki.mypressonline.com/xovasodikibosugo.pdfIn PDF document text
    • https://cdn.sqhk.co/jumifokujuje/hcJigia/kigazonimilufe.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e4b7e77-112d-4554-8d1c-2ceaec0924b8/data_structures_and_algorithm_analysis_in_java_3th_edition_by_mark_weiss.pdfIn PDF document text
    • https://s3.amazonaws.com/fakuguvil/rowoseravaxetapamezidov.pdfIn PDF document text
    • https://s3.amazonaws.com/luborinizu/62252045575.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/387c6761-00e0-4f4e-94b3-fa157895fbab/34093349143.pdfIn PDF document text
    • https://b01cffea-7a05-49e8-9781-04202a21c04b.filesusr.com/ugd/d5d855_4a802b929dee45e9994ffb8722e05558.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fibesezati/gowov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/446c7a32-0787-469a-9401-57f921aaad7f/pixenuwifubixatuweb.pdfIn PDF document text
    • https://efa91360-7c21-416c-9d60-3189e0beb381.filesusr.com/ugd/42ffc7_3dd33f91f5154d1e9fa7d7281b23ab01.pdf?index=trueIn PDF document text
    • https://3a00e800-a8eb-44ae-aafc-ae9aecab8e06.filesusr.com/ugd/1715bf_77a80e3624e64408929dcd94edaebc0e.pdf?index=trueIn PDF document text
    • https://cf587a47-7c2f-4f55-8bbb-21a4c73503f7.filesusr.com/ugd/8ea597_1b47cf4c1fd243019d30008fb749b67a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4eb7b77b-66d4-4d15-9f5f-bc41a7aba528/perimeter_and_area_class_5_worksheets.pdfIn PDF document text
    • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_5e9475bb7c994253965eafcd44d73461.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC61 5312 bytes
SHA-256: 0a2379af2695f443e0b23c1caf3ed8fe7c3e307ed3d8c974899038e25e4f0618
font_01_sfnt_off00010e5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E5D 12580 bytes
SHA-256: d8fe26e6a137cea521dbe03aa7d64d3f2bdff7cf6896389f38ac76796db59e91

Open this report in the interactive analyzer, or submit your own file for analysis.