Malicious PDF — malware analysis report

Static analysis result for SHA-256 684d0baf45411a9f…

MALICIOUS

PDF

87.2 KB Created: 2021-01-18 22:06:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: 63063ea4b8303fc7a8d418f89142fb50 SHA-1: 77819390c5315a30cb67e06a5a66f54ac731e82b SHA-256: 684d0baf45411a9fa655b670e6e0d18edfd7975127292a211704533fb4889080
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one prominent URL pointing to a domain associated with phishing and malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, suggests a lure related to educational content, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=lesson+3.3+practice+b+geometry+answers+proving+lines+parallel PDF link annotation
    • https://site-1168140.mozfiles.com/files/1168140/35009611127.pdfIn PDF document text
    • https://site-1251344.mozfiles.com/files/1251344/calendario_accademico_unimib_scienze_della_formazione.pdfIn PDF document text
    • https://cdn.sqhk.co/rakuvonume/RGC1DEX/nhl_store_near_me.pdfIn PDF document text
    • https://cdn.sqhk.co/disonixures/pi7ieeK/lego_super_heroes_robo.pdfIn PDF document text
    • https://cdn.sqhk.co/bitaxukezor/aifiaji/28470474784.pdfIn PDF document text
    • https://site-1166042.mozfiles.com/files/1166042/bendix_brake_catalogue.pdfIn PDF document text
    • https://cdn.sqhk.co/lopumilekana/2s5G75d/52635665463.pdfIn PDF document text
    • https://site-1190022.mozfiles.com/files/1190022/finuguwezanawazefukofub.pdfIn PDF document text
    • https://cdn.sqhk.co/gepeduvo/hbbghjb/weapon_builder_pro_apk_free_download.pdfIn PDF document text
    • https://site-1248249.mozfiles.com/files/1248249/micromax_android_one_stuck_on_boot_screen.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fotojipifuzitul/leselurimul.pdfIn PDF document text
    • http://relimimukavewuj.rf.gd/41692492716.pdfIn PDF document text
    • https://s3.amazonaws.com/mawesenasijoser/1784872952.pdfIn PDF document text
    • http://furofazitogo.epizy.com/lejosolelevinopiduvuviw.pdfIn PDF document text
    • https://s3.amazonaws.com/megodipewukitoj/choir_uniforms_snl.pdfIn PDF document text
    • https://s3.amazonaws.com/viregujipowuru/pasuti.pdfIn PDF document text
    • https://s3.amazonaws.com/wewiro/wow_tavern_tailoring_guide.pdfIn PDF document text
    • http://vufagozujidivu.epizy.com/17357006443.pdfIn PDF document text
    • http://muvubavove.epizy.com/nakoluriduvu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB25 3176 bytes
SHA-256: b370e97bb7eb475ab288f4c8c839210d7dbf6fb0b3b91f3f98d8f242ece8868b
font_01_sfnt_off0000f66f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF66F 5784 bytes
SHA-256: dd05828fd82897fdcb8719cdc1b165c9b9e0044f7a5999a1456d77a7a28095de
font_02_sfnt_off00010a26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A26 1756 bytes
SHA-256: 7503844a1bac0f4ca60cee8f74bf0a428f19fe11ab87d6117199fe074c2440bc
font_03_sfnt_off000112d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112D3 11160 bytes
SHA-256: 71e94806b8e924acc8eef3043aafa3d1e09debde6935ecff19eb49f4b074b7d2
font_04_sfnt_off0001390d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1390D 16076 bytes
SHA-256: 571aff1669bb6bf9d09bab278ac5a490aede0655bcfbcdf11524ff05be50a676

Open this report in the interactive analyzer, or submit your own file for analysis.