Malicious PDF — malware analysis report

Static analysis result for SHA-256 73d75a9832916373…

MALICIOUS

PDF

75.3 KB Created: 2021-03-09 05:51:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f21d857f92f2e9203de2c7abe6122f2e SHA-1: d5aa13380c15e4ef8b2abf54a54dc91386439ce5 SHA-256: 73d75a9832916373598db040b513d63ed0b7f8b91dd5500919ab1ccf602ca962
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing multiple embedded URLs, with a high ML score and ClamAV detection indicating malicious intent. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests the PDF is designed to host numerous links, likely for phishing or malware distribution. The presence of external URIs and the overall structure point towards a phishing or malware delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=invisible+cities+review
    • http://moitender.org/hbase_commands_cheat_sheetb29z8.pdf
    • https://cdn.sqhk.co/kizajituxab/Zhfgcot/55658008916.pdf
    • https://cdn.sqhk.co/mawejoxejobe/ijUjie0/dead_trigger_2_pc_download_free.pdf
    • http://heymama.store/ximitemifesxaqw5.pdf
    • http://closemaze.com/dean_lewis_be_alright_sheet_music_pianozfll6.pdf
    • http://putifid.iblogger.org/what_does_it_mean_to_be_a_leader_in_early_childhood_education.pdf
    • https://cdn-cms.f-static.net/uploads/4455907/normal_5fd67fc11a9c6.pdf
    • https://cdn-cms.f-static.net/uploads/4477658/normal_604204beb6723.pdf
    • https://cdn.sqhk.co/sitopizol/khhXhfz/gaming_monitor_for_xbox_series_x.pdf
    • https://cdn.sqhk.co/xuzuvazol/gjgchiZ/13041568226.pdf
    • https://cdn-cms.f-static.net/uploads/4499021/normal_60134456e5b86.pdf
    • http://mefizilexofe.66ghz.com/hormone_replacement_therapy_australian_guidelines.pdf
    • http://mushygushysayings.com/mosenosalegc0hni.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3fd80896-c652-4f12-be32-2d6b313f63ed/21072785272.pdf
    • http://tezufawifejede.epizy.com/adeste_fideles_latin.pdf
    • http://jofesosozofoso.epizy.com/vupetuxe.pdf
    • https://uploads.strikinglycdn.com/files/69635bb0-1354-4cb3-b83a-8ff310c22a3f/algebra_de_baldor_libro_gratis.pdf
    • http://lebodevafetag.epizy.com/gudevasag.pdf
    • http://zebigibozudival.epizy.com/wagaseje.pdf
    • https://uploads.strikinglycdn.com/files/8a135a2b-b941-496e-be49-1e096652b964/tajweed_rules_of_the_quran_in_urdu.pdf
    • https://uploads.strikinglycdn.com/files/05c3861d-4a68-43d5-96bd-144105eb393d/how_to_connect_xp_series_gaming_chair.pdf
    • http://jijekoseme.epizy.com/the_power_of_one_pokemon_full_movie.pdf
    • http://wokolutomi.rf.gd/pufobe.pdf
    • http://zaretinigalowu.rf.gd/noruxapokukubig.pdf
    • http://ketaxesam.epizy.com/besufinimesesowexibox.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb94.bin
dec9151d66565271e7a1057bcf19a2d9abc5de13c4b4fdbe85d8c51795d71517		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB94 4812 bytes
font_01_sfnt_off0000fc19.bin
244ee081a921031d480792e4e870d2b066e96fc8e8bfa7d25eee455b59dff2d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC19 10488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.