Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a22920fee301722…

MALICIOUS

PDF

76.6 KB Created: 2021-03-15 10:13:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6e3a75524c028f2b38190c4586ee3fa3 SHA-1: 70f8f5554f5a9d665703efa49db6d9501c41bd8f SHA-256: 6a22920fee30172289a7494c65735da540f0964d329012b3f6d6b3342e7af00a
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file is classified as malicious by ML and ClamAV, and exhibits characteristics of a link farm designed to redirect users to potentially harmful websites. The document body, though heavily obfuscated, appears to contain keywords related to 'boot camp prices' which likely serve as a lure. The presence of numerous external URIs, many hosted on disposable domains, strongly suggests a phishing or scamming operation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=grand+haven+fit+body+boot+camp+prices
    • https://sezowizubuv.weebly.com/uploads/1/3/0/8/130874308/gopanivofudedogute.pdf
    • http://tryadasert.online/resumen_de_100_aos_de_soledad_en_inglesbewf7.pdf
    • https://cdn-cms.f-static.net/uploads/4392462/normal_603f2f9852964.pdf
    • http://tokexal.medianewsonline.com/56588992090.pdf
    • https://tubemugipowiw.weebly.com/uploads/1/3/4/3/134345788/7214031.pdf
    • http://tryraisins.pro/three_days_potty_trainingjiejc.pdf
    • https://cdn.sqhk.co/juzosugun/ifjdgcj/drawing_grid_maker_apk.pdf
    • https://pavadugubuwab.weebly.com/uploads/1/3/4/3/134309483/01157ce1.pdf
    • http://kerosijuvibeg.scienceontheweb.net/xarudeber.pdf
    • https://cdn.sqhk.co/gixotagokezu/qLhfii9/11384401630.pdf
    • https://cdn.sqhk.co/wijanotunam/ifiigd6/49065585528.pdf
    • http://dithetsen.xyz/how_to_lubricate_bostitch_nail_gunbpxn6.pdf
    • http://duzusedolatepe.mypressonline.com/tukaganozotu.pdf
    • https://static.s123-cdn-static.com/uploads/4447253/normal_5fcb956f2feb1.pdf
    • https://cdn.sqhk.co/rufivobu/jwZgifR/convert_file_to_iphone.pdf
    • https://texoxarisozitew.weebly.com/uploads/1/3/0/9/130969357/f8ecc432d.pdf
    • http://torixobo.mypressonline.com/artemis_fowl_the_eternity_code_graphic_novel_free_download.pdf
    • https://xoxajunun.weebly.com/uploads/1/3/4/3/134351876/fe2d9dd.pdf
    • http://nout-prokat.website/ticket_to_ride_europe_rules_stationszhalp.pdf
    • https://cdn.sqhk.co/bilanogakiw/icyjb1G/colour_fill_3d_app.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8fa10226-37c2-454d-bd65-ced70ecbf0c4.filesusr.com/ugd/c34aa9_09e243cf4ccb40dcaf06a3aadea26a37.pdf?index=true
    • http://kaxuwenewutexu.myartsonline.com/how_to_open_sodastream_source.pdf
    • https://6a421494-2577-4416-904f-e17348f56b63.filesusr.com/ugd/85e76a_d66b0961958d41f3b49c2c344ab656dd.pdf?index=true
    • https://3465328d-eb21-4af5-a94e-b8fdacefaafa.filesusr.com/ugd/c63bf9_2521d787a2304891b2c1f95de01a56ef.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec8c.bin
252196090a34f261188700711aed51f6189799cef55ffed7d673816b58916e78		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC8C 5696 bytes
font_01_sfnt_off0000ffcf.bin
76282f8180365f519e6123e5fb4d2d84ad424d517d751386a00943f34368afb9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFCF 10916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.