Malicious PDF — malware analysis report

Static analysis result for SHA-256 688710e5e3573560…

MALICIOUS

PDF

73.1 KB Created: 2021-06-10 19:56:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 064d9954ed2860434f5b89b3d2352430 SHA-1: e82f3fe4a5a4a42b5444068a841f090968837aac SHA-256: 688710e5e35735609b4d727894cf3b82907b63e867ddc970e7b85293269e45b1
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document exhibits characteristics of a phishing lure, specifically masquerading as a free online PDF to Word converter. The presence of numerous external URIs, including a link farm on disposable hosting, and a high ML classifier score strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a potential for downloading a second-stage payload, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=ocr+scanned+pdf+to+word+online+free
    • https://jikidamasot.weebly.com/uploads/1/3/4/8/134874174/kemetebotera.pdf
    • https://wuguxobexo.weebly.com/uploads/1/3/0/7/130739488/rapibofobi.pdf
    • https://cdn-cms.f-static.net/uploads/4487641/normal_6018cdd40d4a4.pdf
    • https://cdn-cms.f-static.net/uploads/4376610/normal_604e0f878d962.pdf
    • https://lakukuvirukum.weebly.com/uploads/1/3/0/8/130874631/9249945.pdf
    • https://static.s123-cdn-static-d.com/uploads/4494432/normal_60b657090f85e.pdf
    • https://tudaxuvogune.weebly.com/uploads/1/3/6/0/136082380/jujovijufunu.pdf
    • https://mufunada.weebly.com/uploads/1/3/4/6/134623537/bulegi.pdf
    • https://static.s123-cdn-static.com/uploads/4369774/normal_5ff9c07646751.pdf
    • https://cdn-cms.f-static.net/uploads/4375088/normal_6014d173dcf7b.pdf
    • https://rofetavagamufup.weebly.com/uploads/1/3/4/3/134373504/gufonaputogatad-teboxobirole-kerojugil.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jesababa.pbworks.com/f/mbd_english_guide_10th_class_pseb.pdf
    • http://najapenoz.pbworks.com/w/file/fetch/144571197/bedubarogileg.pdf
    • http://palejemevat.pbworks.com/f/passive_voice_passage_exercises.pdf
    • http://nenikobowon.pbworks.com/f/30002144031.pdf
    • https://uploads.strikinglycdn.com/files/4e76f624-ee96-45af-9d0d-4c1befe2bf81/17642619346.pdf
    • https://uploads.strikinglycdn.com/files/beb0ea67-ca32-4a64-96d1-9474dcf98102/18826957254.pdf
    • http://nidibewuzi.pbworks.com/f/how_to_change_time_on_reizen_talking_watch.pdf
    • https://uploads.strikinglycdn.com/files/554eb2f2-f312-4bb0-96a1-d1ce4ae82714/academic_writing_online_jobs_in_kenya.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e076.bin
9ae827dfbf1e4ea27ffb2fc9394af24665220f044e61d8393ff979039762de9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE076 5268 bytes
font_01_sfnt_off0000f287.bin
4972a08555d21ce224fd4f3f09aef959e7190b3907ca6e440036d564874f6833		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF287 10832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.