Malicious PDF — malware analysis report

Static analysis result for SHA-256 7104c52bcffc0227…

MALICIOUS

PDF

84.2 KB Created: 2021-03-12 00:03:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: fd4110ba9a0286bda03c270c85a55d10 SHA-1: ddfc4c7a2796e441e87fb269a8f4ed31bf53dba1 SHA-256: 7104c52bcffc0227c56cefe024cfcc2988eb3d2e96655af23d04eb7afac1197c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which point to disposable hosting and are part of a link farm, suggesting an attempt to redirect users to malicious content. The primary malicious URL identified is https://xezojetit.ru/strik, which is presented as a search result for a benign query, likely a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=what+is+the+best+self+help+book+for+depression PDF link annotation
    • http://nubolutlion.xyz/teledyne_laars_boilerzkrj0.pdfIn PDF document text
    • https://femuketidoxesi.weebly.com/uploads/1/3/3/9/133997502/6692085.pdfIn PDF document text
    • https://cdn.sqhk.co/javijaxim/ihhidid/jebasuvazutojodub.pdfIn PDF document text
    • http://svoydvalend.xyz/last_reported_case_of_zika_in_thailandyqz4i.pdfIn PDF document text
    • https://kajubuti.weebly.com/uploads/1/3/2/6/132680994/fojumus-kazekapijodojo-japaxanelize-wefukodomil.pdfIn PDF document text
    • https://cdn.sqhk.co/kopilixa/idyjfii/best_funny_ringtones_2020.pdfIn PDF document text
    • https://vipizavubo.weebly.com/uploads/1/3/1/4/131407691/9e7d5bdda7dcc.pdfIn PDF document text
    • https://cdn.sqhk.co/wajewukudino/gPshjgg/play_bubble_bobble_hero_2_game_online.pdfIn PDF document text
    • http://pedron.fun/remurikipinitijavob83nam.pdfIn PDF document text
    • http://changepass.online/stuart_hall_representation_definitionts16s.pdfIn PDF document text
    • http://itdiscounts.pro/what_is_mississippi_college_and_career_readiness_standards4q6fs.pdfIn PDF document text
    • http://groshyk.site/distributed_hash_table_in_pythonoopn8.pdfIn PDF document text
    • https://bomigisojibovo.weebly.com/uploads/1/3/0/9/130969974/jagenifipawame_kuwizabutoluf_vogibiku_kefurigazijiwu.pdfIn PDF document text
    • http://kfnwejfnkwheklf.space/gajenegonadaviwegajevh318.pdfIn PDF document text
    • http://instapriz.online/10969408776rcr8p.pdfIn PDF document text
    • http://homiak.fun/16524489161u5g6m.pdfIn PDF document text
    • http://pasendapp.online/kesuwoxivujibk9b4n.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f8b2de7a-6012-4721-b8f1-df5267d6bb95.filesusr.com/ugd/8ebb60_700c787ba716497a8f4cb38b68658d38.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e66b4c87-080f-443e-aef6-0919ad1769e5/39000200291.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6ed951c-681a-4641-8e99-e810ad3c4813/22987033125.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d3a55e6-f59b-4127-8e17-b261097f2fd4/bolens_garden_tractors_for_sale_on_craigslist.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a59c532-16a1-437a-a99e-cfefa7ebf606/is_the_hunger_games_book_appropriate_for_a_10_year_old.pdfIn PDF document text
    • https://d8d078ea-10ec-4787-8e21-ef6e32b87a24.filesusr.com/ugd/8f6098_008ebbe2a29e48fca24312683e3f4996.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010cff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CFF 5348 bytes
SHA-256: d03b26ac5e93a25264b9cd467ec90b79519f87e1dca6d0553d7384a4292a0cc9
font_01_sfnt_off00011f31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F31 10400 bytes
SHA-256: 16cdc347620136fd7e90140afe7cc8efbab246d584f781e6243b8163a348982a

Open this report in the interactive analyzer, or submit your own file for analysis.