Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ea3b67aa8e3a490…

MALICIOUS

PDF

153.7 KB Created: 2021-03-20 05:00:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aaf7ccd7deabc7d081fd96e8020f9dc3 SHA-1: 512295d8f869ecfa45157a68c3edc0d58103af1d SHA-256: 7ea3b67aa8e3a490b554b95c3e81c603155e8a38c7513d501e86caf457089667
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as phishing. It contains numerous external URIs, with a notable concentration on disposable hosting and redirectors, indicating a link farm designed to obscure the final malicious destination. The presence of 'utm_term' parameters in URLs suggests tracking or obfuscation tactics common in phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=jorge+luis+borges+biografia+resumida+para+ni%25C3%25B1os
    • http://barberking.best/48679692417k9lgl.pdf
    • http://d-youtube.com/48443207540wannq.pdf
    • http://how2clever.com/ben_10_omniverse_game_free5tmdw.pdf
    • https://cdn.sqhk.co/bajipugotox/hGqjd4I/tractor_v_phoenix_live.pdf
    • https://static.s123-cdn-static.com/uploads/4456140/normal_5fec294cb2087.pdf
    • http://totalcreditcheck.info/john_deere_tractor_for_sale_-_craigslistp1vps.pdf
    • https://cdn-cms.f-static.net/uploads/4421036/normal_600a213a67657.pdf
    • https://cdn-cms.f-static.net/uploads/4418000/normal_60412a8f9b183.pdf
    • http://zumanidoxup.medianewsonline.com/lights_out_2011.pdf
    • https://cdn.sqhk.co/kibukumivu/aL6ig8S/84704008911.pdf
    • https://cdn.sqhk.co/kibutonap/hgbogjw/stair_rush_3d_game.pdf
    • https://cdn-cms.f-static.net/uploads/4482629/normal_5fd877760948d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_393d66239c734be6956619d7effbd70e.pdf?index=true
    • https://c3bb11cb-ba02-405d-8462-2b4421b436e1.filesusr.com/ugd/4c7814_bfa2287b294f40d093ff4f7b92856776.pdf?index=true
    • https://858e1da1-ad31-4e5b-aec0-89c59c6c71f6.filesusr.com/ugd/6240f8_0c8442788c024e119b970f45e3de6b7c.pdf?index=true
    • https://6e7ef639-f89a-4701-86f9-710a836f1183.filesusr.com/ugd/12745a_f54faf8c4e0b4774b2b0b81d858e430a.pdf?index=true
    • https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_57516c10138d4f30b2a6e323cfb1beb5.pdf?index=true
    • https://69df74eb-9f83-488d-97bb-abb55063df61.filesusr.com/ugd/f34323_f3d8fe46e068414eb63d253f5d5d11da.pdf?index=true
    • https://91953a53-6f32-4f2a-9b2e-0f954541ff31.filesusr.com/ugd/dad90e_6c194fde3c744ba68913c493a761096a.pdf?index=true
    • https://68f2566a-c586-4d15-a5d1-3a72044c38f3.filesusr.com/ugd/ecec20_239a496dadb741e7aa6d816faf27790b.pdf?index=true
    • http://tobidogajetu.onlinewebshop.net/73rd_amendment.pdf
    • http://vexabimumemig.atwebpages.com/parewebubafa.pdf
    • https://972af30b-04c2-4618-b911-83ba0b7fef9e.filesusr.com/ugd/84a5c6_4014972a82c64de5a024938b9e697061.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00021744.bin
86a8a4c58d0164a0fb63d61894a43d99f4772cf3b911d758b32d569c4f02b0a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21744 5700 bytes
font_01_sfnt_off00022a50.bin
75e299d39d9b4683fea507287dbeeacce683adc2cfebcc23941df08079510d00		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22A50 14556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.