Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c6a27332aa9d1a9…

MALICIOUS

PDF

80.1 KB Created: 2021-09-17 06:51:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: d536b33be535e0f9c6f63949d8cd8a30 SHA-1: db0d40af5e80c1fef36f0f62fe64f7d0ee7d0992 SHA-256: 7c6a27332aa9d1a9b3282736b2103d7959217fb084a6ec5e9f773185dd60f8e0
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample was detected as a malicious PDF by ClamAV and an ML classifier. It contains numerous external URIs and is identified as a link farm on disposable hosting, suggesting its purpose is to redirect users to potentially harmful sites. The presence of multiple PDF-specific heuristics further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/uplcv?utm_term=android+candlestick+chart+library
    • http://elliptical-trainers.ru/ckfinder/userfiles/files/96823359027.pdf
    • http://malir-naterac.info/UserFiles/File/sibopijasufewatu.pdf
    • http://liveisagenix.com/ckfinder/userfiles/files/66395049889.pdf
    • http://laiyi-art.com/userfiles/file/sowok.pdf
    • https://www.twibiotech.com/plugin/ce1/ckfinder/userfiles/files/72449742040.pdf
    • http://culbertsonlawyer.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/147020556.pdf
    • http://theponghop.com/upload/files/23629503917.pdf
    • https://associazionedynamica.it/uploads/file/vofivedutadifumatatosol.pdf
    • http://rasmesafar.net/basefile/basefiles/16457841961.pdf
    • http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613c64d88c473---jiwala.pdf
    • https://siphouse96.com/wp-content/plugins/super-forms/uploads/php/files/d4dab40236d14488d5e811308ba0f31d/44279084050.pdf
    • http://hansungid.com/userfiles/file/88462415699.pdf
    • https://zemtechnika.lt/public/site/0files/xobokuzaju.pdf
    • http://conomiya.com/images/uploadedimages/file/36191019248.pdf
    • http://clinivetmadonnadirosa.eu/userfiles/files/76944190779.pdf
    • http://kaztelcom.kz/ckfinder/userfiles/files/85244762280.pdf
    • http://franklcalabreseattorney.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/berepizij.pdf
    • http://nsfeed.com/_UploadFile/Images/file/24860284081.pdf
    • http://mobilesamara.com/img/files/file/patajejudi.pdf
    • http://becucci.it/userfiles/files/fijikeboxavutigekijatujo.pdf
    • http://ljjxmining.com/uploadfile/file///2021091705083863.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cb3a.bin
7d7731d52335b52bca0e84180c4ada08559271b9947a3d8457017047e053b2a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCB3A 10796 bytes
font_01_sfnt_off0000e410.bin
5c1e5391b0b4019be1bb37715a945b7c06b28c0de65035eb6c98d79807a033c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE410 20776 bytes
font_02_sfnt_off00011b26.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B26 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.