Malicious PDF — malware analysis report

Static analysis result for SHA-256 71efaffbd98c4d0e…

MALICIOUS

PDF

86.1 KB Created: 2021-04-02 07:51:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: 255e47175de382157831183632082af0 SHA-1: 204f5db4049e353b66387d8cf647d0f153f8586f SHA-256: 71efaffbd98c4d0e0cccbf5da0ac99b5e604a30b29507583256f5f382777520f
244 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, many pointing to disposable domains and one specifically identified as a malicious redirector. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to financial administration, likely designed to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=administra%25C3%25A7%25C3%25A3o+financeira+e+or%25C3%25A7ament%25C3%25A1ria+pdf In PDF document text
    • http://mivifukatovaga.getenjoyment.net/academic_reading_tests.pdfIn PDF document text
    • http://shopyou.online/76943807569n1z8c.pdfIn PDF document text
    • https://fagutefoxod.weebly.com/uploads/1/3/4/2/134235025/6c0d959b.pdfIn PDF document text
    • https://kewatedodi.weebly.com/uploads/1/3/0/7/130776291/3c32d36.pdfIn PDF document text
    • https://wezawelo.weebly.com/uploads/1/3/0/8/130813956/95d6559a3.pdfIn PDF document text
    • https://motonolezigit.weebly.com/uploads/1/3/2/8/132814123/be4ac7291ec06f2.pdfIn PDF document text
    • https://metasabuvaro.weebly.com/uploads/1/3/2/6/132681671/fefudepi_vasitijiw.pdfIn PDF document text
    • http://naykaryadom.fun/gaming_wallpapers_freesmugf.pdfIn PDF document text
    • https://refaxoke.weebly.com/uploads/1/3/4/6/134602084/3e9a8.pdfIn PDF document text
    • http://mapotilij.mygamesonline.org/79089989310.pdfIn PDF document text
    • http://tonagruz.ru/bezubaan_abcd.mp3_song_free_downloadtxlk9.pdfIn PDF document text
    • http://xivazokib.medianewsonline.com/automotive_wiring_and_electrical_systems_projects_tony_candela.pdfIn PDF document text
    • https://mokoluwi.weebly.com/uploads/1/3/4/5/134595511/9361374.pdfIn PDF document text
    • https://jasazifo.weebly.com/uploads/1/3/1/4/131437377/gikaninobo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://83d7d1d1-3661-4158-a2cc-78aa4aa39d08.filesusr.com/ugd/163759_addab7198bbe4bb6a027835411af9d54.pdf?index=trueIn PDF document text
    • https://f7f2eb1f-4ce6-40bf-b337-6bcc2c9c1a95.filesusr.com/ugd/dc6899_316fe092fa3340469ac33cd4cb41246c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c6ccab4-f578-452f-9be4-3ac576c01fcd/what_is_the_meaning_of_principle_of_natural_justice.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0dd2c8f8-9245-4e3d-b0fa-b1b51032a9ea/accu-chek_multiclix_lancets_walmart.pdfIn PDF document text
    • https://d23eb412-52e1-45ef-a32a-0c032022daee.filesusr.com/ugd/03485a_0f9288295da04db2b5e887c41d4b598d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c3a70ca-5211-4b8a-a01d-033b3bc41978/wejovugonepurini.pdfIn PDF document text
    • https://56a7be67-7dca-40da-a973-69ad719fb73b.filesusr.com/ugd/fedf23_e65bf498d86d41e4a5e23783573f11f1.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d297b8d-cefe-4df7-9764-ad0cd3c7d006/how_to_play_cribbage_2_players.pdfIn PDF document text
    • https://945c5b1a-9feb-4a08-b72d-c905ca1b1520.filesusr.com/ugd/27135d_7c511df2bcfa497da223e7fd31be666b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8444753d-da50-4fe4-8a3b-1c9838655797/senanawuzazefafawolifimuf.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010da9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DA9 5992 bytes
SHA-256: ad6fb987136352c131196320e03d67026b62d3b833d6a1614ffed4bef4e13b7b
font_01_sfnt_off0001207c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1207C 13068 bytes
SHA-256: d994b70e6e9135c9504f9c7675aa9d4eea7990003471d2bd7cb7a43311db733c

Open this report in the interactive analyzer, or submit your own file for analysis.