Malicious PDF — malware analysis report

Static analysis result for SHA-256 7dde0edb59908429…

MALICIOUS

PDF

82.8 KB Created: 2021-03-26 09:17:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 24c5801fdd158df4421df95d7fee2f28 SHA-1: 304b33623adbf19aba5a78b59e747cd1e73cb2ca SHA-256: 7dde0edb599084296f4734b0144350308e85a6fc447b65a82540909055d08c0b
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing trojan. It contains a large number of embedded links, many pointing to disposable hosting or known malicious redirectors, suggesting a link farm designed to distribute malware or phish users. The document body, though heavily obfuscated, appears to be a lure related to 'vegan recipes book pdf'. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=vegan+recipes+book+pdf In PDF document text
    • https://varijiligedag.weebly.com/uploads/1/3/1/3/131383591/669352.pdfIn PDF document text
    • https://bejobofilu.weebly.com/uploads/1/3/0/8/130814531/dubetexevudirat.pdfIn PDF document text
    • https://nojufetabug.weebly.com/uploads/1/3/4/7/134748112/436db4.pdfIn PDF document text
    • https://worejefaluki.weebly.com/uploads/1/3/4/4/134456715/704837.pdfIn PDF document text
    • https://wagoburaf.weebly.com/uploads/1/3/4/5/134524365/fofavolefemot-dixof.pdfIn PDF document text
    • https://javeleguf.weebly.com/uploads/1/3/0/8/130873961/doxugorit.pdfIn PDF document text
    • https://xisuviwilizej.weebly.com/uploads/1/3/4/3/134320176/reduvanitunon.pdfIn PDF document text
    • https://tiketutowiko.weebly.com/uploads/1/3/5/3/135345961/fomejos.pdfIn PDF document text
    • https://xavapijiwo.weebly.com/uploads/1/3/3/9/133997403/e56da43fec0565.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5224b5a-a59f-430a-a3fb-e6f711836625/28138537641.pdfIn PDF document text
    • https://041aa876-b65b-432c-96c0-58c8b295a4e4.filesusr.com/ugd/90d19e_dfe32adc2166454d918f9d259a37be15.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/40bd771e-6b6d-4dfd-9ff0-41fdaa9f1383/46528722926.pdfIn PDF document text
    • https://19e6fc83-c281-4d06-93fd-e8b16a02b90a.filesusr.com/ugd/ce5d00_9c03064996514f1793586db9fe36419c.pdf?index=trueIn PDF document text
    • https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_673048528ec94a459c281ae7b575d43c.pdf?index=trueIn PDF document text
    • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_604c707d8cc34c4db1e5739689ef776b.pdf?index=trueIn PDF document text
    • https://dc273c12-e125-4738-b2e6-b96bc4bd5eb7.filesusr.com/ugd/c8df25_58fc3ff7f5c4479fa8ace50585dd0b29.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/40e4da2c-d977-4f41-80d8-f7561ef7d50f/how_to_make_a_90_degree_gutter_elbow.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50200785-b33c-4df0-89bf-51e87971d88b/traductor_l_ingles_espaol_gratis_google.pdfIn PDF document text
    • https://be934b08-0dcc-4e2e-8de1-c3c1c32dbfab.filesusr.com/ugd/d5415a_397ac3924bd24b4180ff7ed039146b7f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e813eda7-491e-455c-a409-ffc3f8042f95/zukutaneruz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6729a4d-3827-4528-bfe8-8967a10dfdfe/velanibumuvujeb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a42990f-2cdb-44c5-a40c-74cedad47eec/20022632576.pdfIn PDF document text
    • https://edcb5511-827b-40b0-97c1-3499c313f96b.filesusr.com/ugd/0779a3_bee895699f294614be7561afda9c721f.pdf?index=trueIn PDF document text
    • https://92ddf5cc-4ce7-4caf-b117-8241c553a727.filesusr.com/ugd/42bae0_b4daab0c729541e7a36d4fe16183566c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6415964-3c8a-4db7-b879-d5e92df8820f/setemo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010669.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10669 5460 bytes
SHA-256: 90e4d04bf4f05829dc6b96c84c296a3e71b1279f2b3713ee472fc821ceccca81
font_01_sfnt_off00011911.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11911 10868 bytes
SHA-256: dabd49310ef9cf80eefa7f507fe98287a1a4ec9b8508ff5f7df021329c916c4d

Open this report in the interactive analyzer, or submit your own file for analysis.