Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d1bfb960c0fe77c…

MALICIOUS

PDF

77.0 KB Created: 2021-03-17 08:03:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 1c5a86a9c9ebfe68ddb020d4b2b8c915 SHA-1: 58ecfacec44ace86d6ebb62e99a1d0ef5825f0cc SHA-256: 7d1bfb960c0fe77cd32dc9385b5f6dff6206fcd3a42b7343ea9e3bcf5a691558
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating an attempt to phish or deliver malware. The document body, though heavily obfuscated, appears to be a lure related to relationship advice. The ML classifier and ClamAV detection strongly support the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=como+terminar+una+relacion+que+te+hace+da%25C3%25B1o In PDF document text
    • http://xogezile.66ghz.com/how_to_become_a_cleric_5e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nisiwanolom/sasedeliwedubig.pdfIn PDF document text
    • https://3d7c42e8-cad9-4196-8f3c-0f210fd97588.filesusr.com/ugd/1b7c00_d2e5eec6f85d459bad1c0dbbf5531c16.pdf?index=trueIn PDF document text
    • https://a6132035-7465-4fe4-be4e-2faa96c22dab.filesusr.com/ugd/cf950b_2ccd6899c416415582e07666eaabb25f.pdf?index=trueIn PDF document text
    • https://0296ecfc-28ae-4fa5-925c-67a25994cace.filesusr.com/ugd/c88839_17c21e8623044cc28dd176bd8f03999b.pdf?index=trueIn PDF document text
    • https://5d3a3edc-1384-4eb0-a354-174dd54c13aa.filesusr.com/ugd/7f5dc5_08adfb5f994d4eccb79f86120a05f897.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/45b722ca-09fe-426f-972c-0b639cf95767/breadman_bread_machine_recipes__instruction_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/gurupixabogivaz/2512768041.pdfIn PDF document text
    • https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_8fef32e298514a3ba4101e5d3a90c895.pdf?index=trueIn PDF document text
    • http://xojorefalez.rf.gd/larixulenezoxirajoriw.pdfIn PDF document text
    • https://67536400-2f23-40e2-9d3a-36ae3f4dfb8c.filesusr.com/ugd/5312ea_d33974b440b1454c99baacc99641fbbe.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7a34a05-b9a7-475f-a057-eceea33b3de2/thinking_fast_and_slow_chapter_14_summary.pdfIn PDF document text
    • http://zujexig.epizy.com/potojivevazikusujafiba.pdfIn PDF document text
    • https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_9203702b07344d828fcea2f872cb2924.pdf?index=trueIn PDF document text
    • https://204833c8-abda-4421-8777-5048ee7dd919.filesusr.com/ugd/e30b7a_aeff5fd0cbb647e18840b8cc7948f421.pdf?index=trueIn PDF document text
    • https://6cf80756-66c2-4d2e-b15d-ff1677cb7115.filesusr.com/ugd/2257e8_b36eb0bdd87d428497b54ef3e2f44525.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dutimajizowa/nezavurebokepaxekigopeso.pdfIn PDF document text
    • http://vovodevugawas.epizy.com/listening_skills_worksheets_for_grade_1.pdfIn PDF document text
    • http://gikutixutawax.epizy.com/fdcio222_siemens_datasheet.pdfIn PDF document text
    • https://s3.amazonaws.com/dejolavubukugeb/zukinepifoborofuraro.pdfIn PDF document text
    • http://puloxivomavari.epizy.com/panasonic_dmr-es15_reset.pdfIn PDF document text
    • http://zetusemikaso.rf.gd/how_to_clear_error_codes_on_chamberlain_garage_door_opener.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBFD 5244 bytes
SHA-256: 442a93f0194f88ff896b4c15a418f3cc5cc7a4c2205eaf1983ccabcccba5bcb9
font_01_sfnt_off0000fd56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD56 11792 bytes
SHA-256: fc64c7b8eb2e1073579393a80f1dd2b8152dfc8397f49f3290cef81a83ea4c27