Malicious PDF — malware analysis report

Static analysis result for SHA-256 7042f59fea50f8a7…

MALICIOUS

PDF

104.8 KB Created: 2021-04-01 09:41:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e6b85135abbb119aa0765dc18b493e3d SHA-1: 74841f180e8002bfc3c11cd5b2cca9f620301b3a SHA-256: 7042f59fea50f8a7e34627570c766bf08e1eb07eb6802f3df0d9bfa1bf8f30a6
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it functions as a link farm on disposable hosting, with multiple embedded URLs pointing to PDF files. The document's content and structure strongly suggest an advance-fee scam, aiming to trick users into downloading a payload via a call-to-action button.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=affairs+cloud+weekly+pdf+january+2019
    • http://pewujok.mypressonline.com/telofujezigav.pdf
    • http://custits.space/sulisukixejojafoxufupirfu6.pdf
    • https://cdn.sqhk.co/tozerutiwezu/e2Zb4Oq/jelejilisurubineluvi.pdf
    • http://reduslimitalia-official.site/46568634762tivlu.pdf
    • https://static.s123-cdn-static.com/uploads/4419849/normal_5fc93048dd618.pdf
    • https://cdn.sqhk.co/mibemofega/dljilx5/paris_travel_guide_book_free_download.pdf
    • http://rcasino.info/5918196703847v40.pdf
    • https://cdn-cms.f-static.net/uploads/4415783/normal_60475b7974e29.pdf
    • http://xajavawinereko.mywebcommunity.org/jepurexaravode.pdf
    • https://cdn.sqhk.co/javepuju/A59bgiD/42366152943.pdf
    • https://static.s123-cdn-static.com/uploads/4486359/normal_5ffb8e5a835f5.pdf
    • https://cdn-cms.f-static.net/uploads/4470696/normal_602ffb40a4d87.pdf
    • https://cdn-cms.f-static.net/uploads/4483833/normal_603c50c96a9aa.pdf
    • https://cdn-cms.f-static.net/uploads/4365612/normal_6042f1a9e1a42.pdf
    • https://cdn-cms.f-static.net/uploads/4374371/normal_604491b4d9ab7.pdf
    • https://static.s123-cdn-static.com/uploads/4473618/normal_5fddc021a7fe7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://neloralo.myartsonline.com/medical_microbiology_4th_edition_free_download.pdf
    • https://2b08c346-38d8-4763-b559-bb9d4fff2313.filesusr.com/ugd/40c9d6_6390fe53c1a1430d905ebdda12e74125.pdf?index=true
    • https://e108c0fa-8e70-4110-aab7-e0d30777705f.filesusr.com/ugd/d9966b_03540b7012cf470083041f9167b68fb5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015824.bin
dec1c6fe1195baa37b8cf3ca1bd3ace80512e43ce484977f4b19edba8dabe9ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15824 5956 bytes
font_01_sfnt_off00016c9d.bin
05eec459b0548f4e329202c1ce965717c1e82ba83c0acf9258ce4c49ef029960		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16C9D 11524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.