Malicious PDF — malware analysis report

Static analysis result for SHA-256 6504322e72a1485c…

MALICIOUS

PDF

94.5 KB Created: 2021-03-18 03:52:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: c41e1ef973730002454398688a75fe39 SHA-1: 4f6248012cc59f20a922a99dc58792aa20970109 SHA-256: 6504322e72a1485c2f17df05c4279af56eea769ed245143c2548541b74db7bd7
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing attempt. It contains an embedded URL that redirects to a suspicious domain, likely to host a malicious payload or phish for credentials. The document body, though heavily obfuscated, suggests a lure related to an operation manual.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=krones+bottle+filler+operation+manual+pdf PDF link annotation
    • https://cdn.sqhk.co/kawinojos/icgdIid/19802065436.pdfIn PDF document text
    • http://wiboratiraveguw.mygamesonline.org/30156810470.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374024/normal_5fc71c15491e0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450870/normal_600256d8ccfcc.pdfIn PDF document text
    • http://ribavid.medianewsonline.com/manorama_calendar_2020.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379485/normal_5fde2ef659a6f.pdfIn PDF document text
    • https://cdn.sqhk.co/dawadetugas/hemsSfr/khan_academy_eureka_math_7th_grade.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444102/normal_602425e0048e3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_81209387b7c74e1fa9d13541b5a9fd67.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cd98df3-3eff-4b44-9cd0-5ae9213e2ef9/firozigejurofufan.pdfIn PDF document text
    • http://taberadajip.atwebpages.com/acta_constitutiva_de_una_asociacion_civil_en_mexico.pdfIn PDF document text
    • https://s3.amazonaws.com/fajetufekejo/22940441576.pdfIn PDF document text
    • https://cc968bdf-8a18-4a65-a72d-893c706ef441.filesusr.com/ugd/bae363_aaa3f1b6525e400c931b4b13760af8a9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zibenoroduzuw/vuturidumawonebini.pdfIn PDF document text
    • https://6cb1c90e-07cf-4522-b85d-4edd8abc33c8.filesusr.com/ugd/0c41e7_ef1d16c0287849baab5c381537fbe09c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9764c462-ac80-4580-a387-799b2d187d15/marquis_de_sade_books_list.pdfIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/transformers_black_mamba_starscream.pdfIn PDF document text
    • https://9df6e0af-a028-4e88-91ba-61a1b37318d5.filesusr.com/ugd/7c1f05_d06d08b194eb4b03acab637801f3f271.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zupenafud/vinavomiravevade.pdfIn PDF document text
    • https://56a7be67-7dca-40da-a973-69ad719fb73b.filesusr.com/ugd/fedf23_8398a96c90dd448dacab129ee1c0831c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bezutu/jirizilizozewupamoren.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/260a289b-1d0d-487e-be04-f4ff08996462/sizabikolivuzoden.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001311f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1311F 5296 bytes
SHA-256: 42f5751c67ab8bcf33a34743828251efbe1ef1f9bbe90f8d2a5d641a52797bb5
font_01_sfnt_off00014308.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14308 11672 bytes
SHA-256: 3020b87ae42cbbd6382dd6652722300de208115d837bf636619f5ba8167c4793

Open this report in the interactive analyzer, or submit your own file for analysis.