Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fdc0c09114eca75…

MALICIOUS

PDF

82.1 KB Created: 2021-03-05 15:54:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 9364f70a21671297bf6f80e954ba25b3 SHA-1: 7235cc149e81a2da75deb400209f53c2da07fa95 SHA-256: 5fdc0c09114eca75996fbca45f14724f99a565574d9ebc3d0947a3dd7f5d47eb
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain ('jottigo.ru') that is flagged as external. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for potentially malicious content. ClamAV detection and ML classification strongly suggest malicious intent, likely phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wix?keyword=physical+science+chapter+17+section+2+review+answers PDF link annotation
    • http://kutegexuwudaro.getenjoyment.net/2005_honda_civic_hybrid_maintenance_schedule.pdfIn PDF document text
    • http://kiladuwujufuzav.22web.org/wimisazumuduwomir.pdfIn PDF document text
    • http://serdyukov.pro/simple_flower_garden_design_ideasuv27w.pdfIn PDF document text
    • http://befigter.xyz/renewizisirupehzi2d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://592908bf-dd96-48cc-88d9-ffebbdd10d84.filesusr.com/ugd/f34823_014eaa4f42264a7280a10b47e1a0217a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wupiwupiwot/24573770603.pdfIn PDF document text
    • https://44f68060-d5e3-4d58-b4e7-e3760392f352.filesusr.com/ugd/49488e_df283d7a54ce487ca75d1a6eee0657ee.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/desekusoxi/gravimetric_analysis_of_a_metal_carbonate_answers.pdfIn PDF document text
    • http://zesafemumibow.myartsonline.com/97699499599.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3cfe2689-33f7-43d6-9f2f-a4c56f854a3e/82823294186.pdfIn PDF document text
    • https://58552d80-c20c-4e4f-99b9-91bedbcc07a3.filesusr.com/ugd/c18496_f5ed036a2a2b4395ac039c7b515d72f1.pdf?index=trueIn PDF document text
    • https://f61a8d15-835b-4c36-a3db-e4ead73ab13f.filesusr.com/ugd/e9f5f3_8e5c513cd78146f0b57b703b6f7024b4.pdf?index=trueIn PDF document text
    • http://xizesewidepo.epizy.com/kupape.pdfIn PDF document text
    • https://s3.amazonaws.com/dazinibonofobi/what_to_write_in_a_godson_card.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/522f6fb6-57e0-47f1-95d3-6de493f57119/kiguritonilof.pdfIn PDF document text
    • https://s3.amazonaws.com/jedobufudajewu/bambukat_movie_all_song_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9f55e00-3adb-4015-abf9-873c4a6f37f2/17225296348.pdfIn PDF document text
    • https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_0f266cb994a34bb299af149b31fce4d7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6bb0b35b-96da-4f97-82ef-3901406a812d/nuance_power_advanced_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/43d6fd67-c283-45e4-991a-6f08731148ff/kigogolibil.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f767.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF767 5540 bytes
SHA-256: ca0e6b7be668d4aef029e900be79c1407e19566604d67ef9d18e18e6034d34b7
font_01_sfnt_off00010a61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A61 14588 bytes
SHA-256: a549418e9d92d6f1ebb631488b34b934d57f89d396ab9161054e3299a4e2e56e

Open this report in the interactive analyzer, or submit your own file for analysis.