Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bb745c66001563c…

MALICIOUS

PDF

80.8 KB Created: 2021-03-07 07:49:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 848011b36db1ecfd06c3098b745e672f SHA-1: b41dc01075f8256802089dbd2c202efbf7050fb3 SHA-256: 7bb745c66001563ce477fc56656ceae8a28c1586f133f414dda3ca8d5199de37
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics as malicious, including a critical alert for linking to known malicious redirector infrastructure. The ML classifier also returned a high confidence score for maliciousness. The embedded URLs, particularly 'https://crophysi.ru/aws?utm_term=how+to+shade+red', are indicative of a phishing or malware distribution attempt. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/aws?utm_term=how+to+shade+red In PDF document text
    • https://cdn-cms.f-static.net/uploads/4418192/normal_603f117728481.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459916/normal_6036701a9db69.pdfIn PDF document text
    • http://nixekagog.22web.org/what_are_the_types_and_classifications_of_antibiotics_and_their_actions_ati.pdfIn PDF document text
    • http://minomesiguziv.22web.org/rubevukibekotoruraben.pdfIn PDF document text
    • http://nebobewodog.iblogger.org/how_to_write_videography_business_plan_for_investors.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374956/normal_6029dd38747b6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4424985/normal_5ff7eda366328.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://e8f98835-b194-42a5-b43f-fe2f29920dd6.filesusr.com/ugd/bf650e_c2d006a7fdbd496c8fc40d222487432a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gekojulog/negom.pdfIn PDF document text
    • http://nimunofat.epizy.com/tagekub.pdfIn PDF document text
    • https://s3.amazonaws.com/fovezewi/formation_adjointe_administrative_immobilier.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/727bf782-5abc-4622-8547-420d01ac3b41/33816778207.pdfIn PDF document text
    • https://84d5b3ab-51dd-4312-87b7-51df18fb3b26.filesusr.com/ugd/9ea9b6_ccc20c1e7f994fedb42e64d23ab998b9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dfa99f04-8cba-45a8-baa0-b966f5174fcd/fafofu.pdfIn PDF document text
    • https://0f926834-650c-4d5a-b53c-ad60ae412ccc.filesusr.com/ugd/6a44d8_13cc5596d7194bf9a40124386ccd8348.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c68f01e3-6f1a-436f-add3-6d74a9a38fab/is_james_allen_a_good_place_to_buy_diamonds.pdfIn PDF document text
    • http://manisamat.epizy.com/rabaranexebix.pdfIn PDF document text
    • http://mevutaleb.epizy.com/jeopardy_alto_sax_sheet_music.pdfIn PDF document text
    • http://gituloropo.rf.gd/53068692672.pdfIn PDF document text
    • https://s3.amazonaws.com/peveziwoguxuzam/vibez.pdfIn PDF document text
    • http://sakamajuxuga.epizy.com/alphabet_printing_practice_sheets.pdfIn PDF document text
    • http://tibobabinenan.epizy.com/revuxalowiwexavaxev.pdfIn PDF document text
    • https://s3.amazonaws.com/dowesitobuga/letter_h_worksheet_preschool.pdfIn PDF document text
    • https://d5aacb37-8766-4234-9cc8-c2ec3b911aba.filesusr.com/ugd/1e723b_54c5e59d4873426599239730e72a146b.pdf?index=trueIn PDF document text
    • https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_8162fd96dec7408991e22cc32d65ff7d.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f41c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF41C 4568 bytes
SHA-256: 1513398d1c4fb0715c95d173c26b8510f47366ee47d2c9e85550b10eb5148903
font_01_sfnt_off000103b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103B5 10652 bytes
SHA-256: 59c8dc931feec8de8109128da8e2c71373270745d7cb74f8981c9530cb088f25
font_02_sfnt_off000127e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x127E7 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.