Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f2badc06fa04a3c…

MALICIOUS

PDF

180.2 KB Created: 2021-04-02 11:13:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: d9de51d4d2cba630fe3b4f9c0de0184a SHA-1: 1ccb936163222017e207de5b40efe3ce8ee5897f SHA-256: 5f2badc06fa04a3ccd9c42c58a338a79f99d59ce47f10cafe207dc4cd0d025d0
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to disposable domains and are part of a link farm, suggesting an attempt to redirect users to malicious sites. The heuristic 'SE_URGENCY_LURE' indicates the document may contain deceptive language to prompt immediate user action, further supporting a phishing or social engineering attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wix?keyword=bay+port+wrestling+tournament PDF link annotation
    • http://mnogoturov.com/the_criterion_collection_wikiklv0w.pdfIn PDF document text
    • http://realwockyc.info/vukotidabaejd5n.pdfIn PDF document text
    • http://datingdate.site/25260439864pifc3.pdfIn PDF document text
    • http://parralax.net/belemijoxamafirry74y.pdfIn PDF document text
    • http://wordsidepost.top/tasovijerint4nr.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409420/normal_605f6584e30e3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381094/normal_5fd19a9467a0e.pdfIn PDF document text
    • http://ygrash.website/jajufewuwomolibiruwopitlhnn.pdfIn PDF document text
    • http://trendmobile.ru/rumilojexo9ydct.pdfIn PDF document text
    • http://vinorama.fun/julius_caesar_character_chart_worksheetlz451.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393349/normal_601b442448662.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4443799/normal_5ff359e4616e5.pdfIn PDF document text
    • http://limaxinsto.xyz/g-shock_ga110gb-1acr_watchywkr7.pdfIn PDF document text
    • http://counterman.ru/historia_del_diseo_industrial_oscar_salinas_floresr5e1k.pdfIn PDF document text
    • http://naturagrush.space/kajilojesipojisie3eir.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c02f518-e43c-4fea-b1c3-0afcfdedd4e2/zubudujevevevamoxowoz.pdfIn PDF document text
    • https://bcbc83ff-a82b-4234-bf1d-c69e8cae54d5.filesusr.com/ugd/057c82_4e0bbdbe00104d4a8d6be687869fdab6.pdf?index=trueIn PDF document text
    • https://6448a590-b571-4b71-a9e4-820b8531b153.filesusr.com/ugd/782be2_4c0d1bac6abd4985bfdcb3c326d5dd05.pdf?index=trueIn PDF document text
    • https://63b1f34b-4847-450f-8d9a-4788d10e1cf5.filesusr.com/ugd/451a43_7b72a9788a5146019a2e4afe69b47397.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b6e6393-a79c-49cc-a841-878a18873bf7/pencil_drawing_animal_pictures.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f74d6b8a-140a-4041-a1b1-6f2c9a4427d7/2005_buick_lacrosse_headlight_assembly_removal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d2e3e515-1ac6-4e0c-ad42-c86866fa28ff/24923924925.pdfIn PDF document text
    • https://7fad2989-91b8-457c-89bc-9a0e7aeef19f.filesusr.com/ugd/b03ff3_a505bba5f7f44acb8b59d9f19455eb21.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ecc5f353-2029-4ad6-b8aa-463b8a80fc40/tarot_decks_for_sale.pdfIn PDF document text
    • https://5e54d98c-4257-4cc7-9010-48f3df296eb2.filesusr.com/ugd/05240c_598ab7f134144089ba3b4a0e57f144ba.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000230b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x230B1 6440 bytes
SHA-256: a606a6dede3b99472d2ac97761204782646b5f75106b48d1abccbe9a99ca9a4c
font_01_sfnt_off00024074.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24074 6040 bytes
SHA-256: fab714210d88e252fb4287eafaf555056f23886b510b3c757ffca8594486d534
font_02_sfnt_off00025523.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25523 5380 bytes
SHA-256: 93d3612eeff9f3e60c911b980aa72aa9fb912a81907cb7d6f8f43f591aee7ee6
font_03_sfnt_off0002676e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2676E 7032 bytes
SHA-256: dc45c90b8a630a8aeaad5d957682f4f89642029bccb94116a01f81f992a7ee9d
font_04_sfnt_off00027ea5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27EA5 13184 bytes
SHA-256: 657f51a5fcfe0530855e1f1235c88e9fae4f8d4b54309e4e0a9e8dbfd1025d27
font_05_sfnt_off0002a9e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A9E9 16212 bytes
SHA-256: bde9cdd850da157cd67e8b268a8a2be42ac7d5045be5a97802eb9a53f0c57763

Open this report in the interactive analyzer, or submit your own file for analysis.