Malicious PDF — malware analysis report

Static analysis result for SHA-256 644a250a784c4443…

MALICIOUS

PDF

76.6 KB Created: 2021-03-04 20:18:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 06938ea48c439a0bbf638698f8895222 SHA-1: d242b37c9c1dc5dd693dfad21cd8836209f326b5 SHA-256: 644a250a784c4443779df7d5d3f4e9ce163ef607b1fe1c42e3b7b688bcbd412f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, likely intended to phish users or deliver a payload. Heuristics indicate the PDF is part of a link farm on disposable hosting, and a machine learning classifier flagged it as malicious. The document body, though heavily obfuscated, appears to be a lure related to academic search results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wb?keyword=derrida%20before%20the%20law%20summary PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4469350/normal_603d039c66670.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369164/normal_5fd714bc2a0ab.pdfIn PDF document text
    • http://furogoverakafex.22web.org/ten_sport_live_streaming_apk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412174/normal_60320272b535c.pdfIn PDF document text
    • https://kewegiru.weebly.com/uploads/1/3/1/4/131438086/fexilevan-gupasifego-bopemefixaf.pdfIn PDF document text
    • https://fanonobumoxevo.weebly.com/uploads/1/3/1/3/131384335/lebomirenokomob.pdfIn PDF document text
    • https://batapasupo.weebly.com/uploads/1/3/1/4/131482803/wubuvupe_juxap.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420610/normal_602430461ea6e.pdfIn PDF document text
    • http://ramubananene.iblogger.org/cereus_cactus_information_in_marathi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4469103/normal_5feb3c90c9306.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485705/normal_600819c85dab9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408485/normal_60388f69116fd.pdfIn PDF document text
    • https://lazekikobetilof.weebly.com/uploads/1/3/4/4/134443651/tejatasowixibosiga.pdfIn PDF document text
    • https://fukituxepuronip.weebly.com/uploads/1/3/4/6/134605821/zemitafolanujosele.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/satuja/hyperthyroidism_pregnancy_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/makumapikeze/charmed_book_of_shadows_replica_pages_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/dofufiri/9652034471.pdfIn PDF document text
    • http://durevitulo.rf.gd/god_of_war_ps4_platinum_trophy_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/susonanezaj/pamofaja.pdfIn PDF document text
    • http://jixepazesobuno.rf.gd/atmega8u2_datasheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE8F 5480 bytes
SHA-256: c6dc6ae551e25bd2a4e9b140e7a8bdf05255c6718b04d315e89f2bc6af1bce16
font_01_sfnt_off0001011e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1011E 10660 bytes
SHA-256: 926341494d3cfa48311e95300552100ef444be3c7238cc0eb4c1dd80a135f3db

Open this report in the interactive analyzer, or submit your own file for analysis.