Malicious PDF — malware analysis report

Static analysis result for SHA-256 6146de5ea213af15…

MALICIOUS

PDF

113.2 KB Created: 2021-03-28 13:10:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dbb6bc41a0d0456eaf53f260ff0b5cad SHA-1: 9f872cc895ce11ac17b73bf5e26c6496d6e3b3ac SHA-256: 6146de5ea213af1544ed3ad65c960f3fa543e8d580ff5b1b16c5c0159cf3bc4b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The presence of numerous embedded URLs, many pointing to disposable domains and link farms, suggests a phishing or malware distribution campaign. While no scripts were explicitly extracted, the PDF structure and URL patterns are consistent with attempts to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8693

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=what+does+misspent+mean
    • http://kungfumalibu.com/lexus_es300h_hybrid_battery_replacement6c20e.pdf
    • https://nogetutiru.weebly.com/uploads/1/3/4/7/134711470/telixoravej.pdf
    • http://hugertely.xyz/what_does_equality_before_the_law_meanzg3vj.pdf
    • http://housefashion.ru/vigitejojdi1d.pdf
    • http://clipshd.design/grammar_practice_worksheets_10th_gradeill4u.pdf
    • http://fruitnaturs.space/world_conqueror_1945yfsps.pdf
    • https://memapuzubabevu.weebly.com/uploads/1/3/0/8/130813849/wowujoparikitipiso.pdf
    • http://coins24h.com/662607090620mxnt.pdf
    • http://oneplusonemain.xyz/balasenebisubegub02hk.pdf
    • https://zejebamusij.weebly.com/uploads/1/3/2/3/132302936/rolibovanatulejomov.pdf
    • http://opensalon.xyz/zolukov888a.pdf
    • http://nakanilo.club/pokimagusuduxuvalunape3dgf3.pdf
    • https://nikojaba.weebly.com/uploads/1/3/4/6/134683319/5160086.pdf
    • https://gijegemolu.weebly.com/uploads/1/3/1/3/131380899/zedexuze-lowevuwobanekor-kufix-fisuremuxazoje.pdf
    • http://nosinoski.shop/sofewumezagadelipijugs08g.pdf
    • http://vkysnaya-eda.site/91390835356548wy.pdf
    • http://shortsomfj.space/10819168379lcd19.pdf
    • http://policyhelpcenter.com/sutalixapudifofokukorija9xlhl.pdf
    • https://diwowure.weebly.com/uploads/1/3/4/5/134592565/xakidazusezo.pdf
    • http://ygrash.website/libros_cristianos_de_interpretacion_de_sueos0d6a5.pdf
    • https://mabajiluvepe.weebly.com/uploads/1/3/1/4/131409333/fototowegovizuj.pdf
    • http://obuv-kozha.ru/dream_meanings_baby_drowningu1ij4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://www.opentle.org
    • https://uploads.strikinglycdn.com/files/e3207cfb-1ad2-45f6-ad8c-c122fedfca5b/how_to_turn_off_summer_waves_pool_pump.pdf
    • https://uploads.strikinglycdn.com/files/c0cad376-13d7-41f3-9966-515898569980/fowabogurimiberenon.pdf
    • https://uploads.strikinglycdn.com/files/b09ab66e-7b6a-496a-b1d3-f636fc81a864/53685268751.pdf
    • https://uploads.strikinglycdn.com/files/7b60021c-9bbb-492a-a586-177356db50c4/49716936292.pdf
    • https://uploads.strikinglycdn.com/files/3031216b-f144-4fa2-91e3-63b090e4d7ee/arctic_king_portable_air_conditioner_not_blowing_cold_air.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off000188f8.bin
b22710da0d81dd36a81e8e78bcecf4ea7c2753a5b0ec201b4feebcf02f812944		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x188F8 18176 bytes
font_00_sfnt_off0000fe16.bin
721cc2fdd3dc595dcb3ceb283710897e6e3f946895107a6db3eba0a731c1121f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE16 5684 bytes
font_01_sfnt_off000111f3.bin
da5d370db061c83a7dcb554ca14897d3d028bcb20440c6aff1580f1469cdf0d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111F3 5084 bytes
font_02_sfnt_off00012323.bin
ff8289fcab20b7b81f5dc7c47458689637225d7099c48932a46d6898d6123f6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12323 2656 bytes
font_03_sfnt_off00012e2a.bin
18b250f24057ce91e4a59b25c1eec79fa8b4d7e2cb9f6c0de02c7e032a072fd4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E2A 2328 bytes
font_04_sfnt_off000138df.bin
5fc9e2cd4e7ad04544edda2023dd698132b65daf167a61e09de9fd8de66d8b52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x138DF 2108 bytes
font_05_sfnt_off000142aa.bin
593a452f0795506ac97007ad32b21767cc543cb1bc716fd74108abb5279d52e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x142AA 6640 bytes
font_06_sfnt_off00015448.bin
e68c9e7974fe1339f7f34034eaa4dfb815a06c7e5dc2f8de4312bfee42cdae5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15448 17412 bytes
font_08_sfnt_off0001a5c7.bin
36e71c95d3b6602ce175a98ac99a2c18c99235fab0e24c6c46ec4ff9e72f8c94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A5C7 3276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.