Malicious PDF — malware analysis report

Static analysis result for SHA-256 772cd51023a106f6…

MALICIOUS

PDF

132.6 KB Created: 2021-04-03 06:57:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 7e7265a3da30305ccf7286164f8b73ae SHA-1: f13bae553f2cb62443caeab9972c3e1fe06f8404 SHA-256: 772cd51023a106f62283c7d6521ac44c60e850c277cbcb52d7ea828ea04d99e3
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple heuristics indicating malicious intent, including invisible links to suspicious domains and being flagged as a link farm on disposable hosting. The ClamAV detection and ML classifier further confirm its malicious nature. The embedded URLs suggest the document is designed to redirect users to potentially harmful websites, likely for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=pdf+cholesterol+diet PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4374203/normal_5fcc2b2f31938.pdfIn PDF document text
    • http://copyright-helps-team.com/52606360088ktpyj.pdfIn PDF document text
    • http://loginwithfb.site/how_to_hard_reset_kindle_4th_generation54ewq.pdfIn PDF document text
    • https://cdn.sqhk.co/purorenutuw/rjhxKS1/scary_skins_for_roblox_download.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487416/normal_600364e54fd65.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484118/normal_6015eb8fd3cf6.pdfIn PDF document text
    • http://gojavodevagajuw.mygamesonline.org/lokodotunosarisinide.pdfIn PDF document text
    • http://okclub.org/quiz_questions_theme_ideas3uwmh.pdfIn PDF document text
    • http://jovasetiveduza.scienceontheweb.net/badminton_history.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366676/normal_6005050a49a38.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376362/normal_6048307589d4d.pdfIn PDF document text
    • https://cdn.sqhk.co/xejudawadoni/ghhbjdW/game_genie_ps3.pdfIn PDF document text
    • http://instapriz24.online/dc_food_establishment_inspection_reportyj292.pdfIn PDF document text
    • https://cdn.sqhk.co/pabefidinaz/atZxPjh/talking_tom_cat_game_download.pdfIn PDF document text
    • https://cdn.sqhk.co/jelivapizivo/hdig5gh/toca_kitchen_sushi_restaurant_hack_apk.pdfIn PDF document text
    • http://kajuzumanaz.sportsontheweb.net/marazzi_mystone_ardesia.pdfIn PDF document text
    • http://zusagukitu.mywebcommunity.org/bocio_nodular_eutiroideo.pdfIn PDF document text
    • http://titanovyi-filtr.ru/1453937260126v2r.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f405dec1-7f90-4f4c-a861-5286f67d0127.filesusr.com/ugd/ab922d_1164a363bae5414fbe978524fd6e0d03.pdf?index=trueIn PDF document text
    • http://sisaxuvelomuz.epizy.com/what_were_the_three_main_reasons_for_the_french_revolution.pdfIn PDF document text
    • http://sojonowiwexus.rf.gd/80394411596.pdfIn PDF document text
    • https://72858ab8-d36f-4bc2-b208-e5ec56e76d01.filesusr.com/ugd/3a4e0e_7d96184de85c4e09987aa79523a03519.pdf?index=trueIn PDF document text
    • http://kasanuvuwa.epizy.com/47924789754.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6D9 63852 bytes
SHA-256: 86085bf480e2c87a5b27acfa966e197f217a8a924f4d61a8e3d5c0182e3baea5
font_01_sfnt_off0001b7a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B7A9 4900 bytes
SHA-256: b52842bcb2d8cb2ac5f963b931ef8b7425fcadc3748c5c3a266a8f582aeb1d74
font_02_sfnt_off0001c852.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C852 11252 bytes
SHA-256: b5574a932c413bb63e21d7fc27052d7a8b457f426d6fd828b25feecdbddc0fe1
font_03_sfnt_off0001eeec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EEEC 16196 bytes
SHA-256: ab88ee0552c0e3f63de41ce736f8b12df66eba36e00887189a948e70e29870c1

Open this report in the interactive analyzer, or submit your own file for analysis.