Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b4a84605bec87cb…

MALICIOUS

PDF

87.8 KB Created: 2021-02-28 16:47:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 6c0cdacff8550c1c58c0e4a92033ad2d SHA-1: 71bd473fe06985a1aae5369f22e467c52c130b6f SHA-256: 5b4a84605bec87cb3386fe18bdb9dda57f0516fef6f184b3aaefc799025f6a8c
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with at least one pointing to known malicious redirector infrastructure. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or distributing further malware. Although the document body is heavily obfuscated, the presence of numerous links suggests an attempt to direct the user to external, potentially harmful, resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=how+to+pot+devils+ivy+cuttings In PDF document text
    • https://cdn.sqhk.co/nobipajami/eOtVgiG/nipituzofo.pdfIn PDF document text
    • http://padulima.22web.org/descargar_traductor_ingles_espaol_gratis_sin_internet_para_pc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486190/normal_60129f9c19658.pdfIn PDF document text
    • http://gemubanabugawa.mypressonline.com/body_rider_elliptical_trainer_and_exercise_bike_with_seat_and_ea.pdfIn PDF document text
    • http://bepegut.iblogger.org/94169904753.pdfIn PDF document text
    • https://cdn.sqhk.co/kagixepo/egiSijA/49211024193.pdfIn PDF document text
    • https://cdn.sqhk.co/puvegipuros/cibijyb/hide_rec_screen_recorder_pro_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/gusiloxi/dvheLXU/68078945062.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483362/normal_5fe8151ee2e64.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rodedewezijore.atwebpages.com/download_murottal_anak_juz_30_metode_ummi.pdfIn PDF document text
    • http://jivatufuwofed.rf.gd/casio_g-shock_sports_model_ga110-1aos.pdfIn PDF document text
    • http://tepuxasimu.rf.gd/interesting_table_topics_ideas.pdfIn PDF document text
    • http://wenares.myartsonline.com/portfolio_outdoor_lighting_transformer_problems.pdfIn PDF document text
    • http://titugol.atwebpages.com/vunevimusenosi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d980.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD980 5148 bytes
SHA-256: 29108bbeb86b083f02f9023d9b17c060b03af18890d16eeb72f2085d1e4d853a
font_01_sfnt_off0000eb38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB38 21368 bytes
SHA-256: e00109614dacb1b47de68db1da2c829cd503e21385355fa62e10086e4ade0797
font_02_sfnt_off00012809.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12809 13008 bytes
SHA-256: 55dfdc45b1b716e8b8c0a169e58a1698e2fd384f2282034e0a16ee43c3298204

Open this report in the interactive analyzer, or submit your own file for analysis.