Malicious PDF — malware analysis report

Static analysis result for SHA-256 755828debe4680f0…

MALICIOUS

PDF

77.1 KB Created: 2021-03-19 20:14:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 55624d28b25be25fa61e26784e9dd153 SHA-1: 72cedfb6ff2b94f9b2d1356ef435a790f1a89fba SHA-256: 755828debe4680f0d4fd16d00ed990a2a7afc60de57938cdc32b5f8d6c5f3bba
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external URIs, including one that appears to be a search result lure for a 'toro 824 snowblower manual pdf'. The PDF also functions as a link farm, directing users to various domains, some of which are unknown or potentially malicious. No scripts were extracted, but the overall structure and URL distribution suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=toro+824+snowblower+manual+pdf
    • http://profmaster74.ru/5018557102vw426.pdf
    • http://fullpisetc.ru/tubopixategavjo57g.pdf
    • https://static.s123-cdn-static.com/uploads/4409395/normal_6000ae0b05396.pdf
    • http://togaxifobuf.mypressonline.com/nuzusepapolarax.pdf
    • https://static.s123-cdn-static.com/uploads/4424040/normal_5ff0ece5c62b1.pdf
    • http://jekeluxuto.mywebcommunity.org/dd_5e_plane_shift.pdf
    • https://cdn-cms.f-static.net/uploads/4464852/normal_6014be56983f9.pdf
    • http://sifimomikev.sportsontheweb.net/game_of_thrones_season_2_episode_10_plot_summary.pdf
    • http://d-youtube.com/gettysburg_address_lincoln4wf14.pdf
    • http://xogavuw.medianewsonline.com/assam_university_tdc_routine_2020.pdf
    • http://vimobewawulipiz.mypressonline.com/hp_deskjet_2132_printer_driver_download.pdf
    • http://fitnesspack.net/download_transparent_screen_and_live_wallpaperzfdr5.pdf
    • https://static.s123-cdn-static.com/uploads/4421207/normal_5ff3eaae5f125.pdf
    • http://dojijoxekomutax.iblogger.org/un_anthropologue_en_droute.pdf
    • http://gejesixave.scienceontheweb.net/85819182020.pdf
    • http://rowomonug.mywebcommunity.org/zogage.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jonesojawu.myartsonline.com/84999490446.pdf
    • http://fidalanono.myartsonline.com/kazilaz.pdf
    • http://gevorewububew.epizy.com/jakedekavasobatumedo.pdf
    • https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_0e49e537491a4cf5b9ff180d64b96452.pdf?index=true
    • https://828c6a01-da61-4814-986a-f72e64f4f334.filesusr.com/ugd/cdfdba_ea96c7375e8943cca3e2d41961e85d6f.pdf?index=true
    • http://vamuxusonepuf.rf.gd/android_one_xiaomi_mi_9.pdf
    • http://bixogonabu.epizy.com/blender_2._79_shortcuts_deutsch.pdf
    • http://pujumek.myartsonline.com/the_cop_and_the_anthem_summary_and_analysis.pdf
    • https://1e438cd7-6f3b-42ac-a97b-d13a75fa135b.filesusr.com/ugd/0c268c_b1508903687b4e3bbac2f30be0d4c2d4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eebf.bin
5c37d884d58de2373ca44f0d261228d7f29a3c0a44d2171427fc54fd29ee6d43		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEBF 5780 bytes
font_01_sfnt_off00010265.bin
7ca445ac70c1e33a5bd1588253c5aca3fb43892c664914dc174893dacc05b66b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10265 10680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.