Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b2782e4ee71a894…

MALICIOUS

PDF

79.7 KB Created: 2021-05-09 06:10:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: df6a67e93ab2a67929cdfc3a258bf905 SHA-1: 7915d7d670ae96a976b9c3a908f5f9934e2582a9 SHA-256: 6b2782e4ee71a894c1b7dc307f67347402f06b1061d46596cb2e371fd715e675
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which are hosted on disposable domains and utilize UTM parameters for tracking, suggesting a phishing or link-farming campaign. The presence of these links indicates an attempt to redirect the user to potentially harmful external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=bissell+proheat+2x+revolution+pet+pro+1986+vs+1550v
    • http://notirebaxomuw.iblogger.org/isometric_drawing_practice_worksheet.pdf
    • http://nenegifivujaxu.mypressonline.com/lejibines.pdf
    • http://rigoditibalun.mywebcommunity.org/gopuzadikifupusenoju.pdf
    • http://kanaxade.mygamesonline.org/54547695502.pdf
    • http://jawunefuda.mygamesonline.org/dewemefanapokanamupaj.pdf
    • http://woxijakuzadajew.getenjoyment.net/91127626763.pdf
    • http://ronifibofizet.medianewsonline.com/ncis_the_river_styx_part_2_recap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zirutabu.myartsonline.com/decluttering_at_the_speed_of_life.pdf
    • https://s3.amazonaws.com/fusopoxipo/c_est_genial_french_book.pdf
    • https://5548a280-a194-4776-8019-0e256783c1fa.filesusr.com/ugd/f2c1dc_2e4addf8f2be47b881cf400211709597.pdf?index=true
    • https://38f9ccf9-db33-4582-994d-0ea518e52d38.filesusr.com/ugd/368de4_c43a33ea68bd4d17b69b939e64c1c0d2.pdf?index=true
    • https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_ebb4d4a4dc6a4b51b6b9f40f561df0a2.pdf?index=true
    • https://s3.amazonaws.com/luborinizu/nogoxiri.pdf
    • https://93641f3c-03d3-4c8c-b6db-0fd9bfabe798.filesusr.com/ugd/384ca7_e6dc65a0b140449c9c3082a05667a5a8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e202525c-7af2-4e16-a536-14ba9ebea89b/55179716695.pdf
    • https://uploads.strikinglycdn.com/files/83a5c537-f66d-4d58-b413-673734d13e08/how_much_does_macbook_screen_repair_cost.pdf
    • https://uploads.strikinglycdn.com/files/7bee696f-caf7-417f-89af-258fd778baee/cuantos_metros_es_un_km_cuadrado.pdf
    • http://munuxodubawuki.epizy.com/87324261495.pdf
    • http://kefabebabefi.rf.gd/business_statistics_frequency_distribution_table.pdf
    • https://s3.amazonaws.com/xowasosuf/zoferoz.pdf
    • http://godosuluto.myartsonline.com/desonenogez.pdf
    • http://mosakokomu.epizy.com/blessing_shumba_new_album_2019.pdf
    • https://uploads.strikinglycdn.com/files/1d6fbed6-bf81-4cf7-9106-cc9c655522e7/is_magic_chef_a_good_microwave.pdf
    • http://vobozezojip.onlinewebshop.net/alligation_and_mixture.pdf
    • http://nakarajibap.myartsonline.com/jitekupebuwufunanerajipeb.pdf
    • https://969948a0-d7f7-4827-958e-a3856fee42d4.filesusr.com/ugd/9d40bc_d3be1c6575184a6e807b6f599fa727bb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f425.bin
695474df72099fd8b449704d256553a18d805f3bad8a36c5b9dce7263d0c80ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF425 6036 bytes
font_01_sfnt_off00010894.bin
110810124bdd561f4393731c4eed78af13c3e6b4950dff9d40953b074bf712ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10894 11200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.