Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fd27d2c256dc074…

MALICIOUS

PDF

86.8 KB Created: 2021-04-05 07:29:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: f2266eface4764ef0b118facaf869a3e SHA-1: cd71ce8ca2eb8ff3821cf6ef54684cb48c493101 SHA-256: 7fd27d2c256dc074d1f24c4a458238b20ce6a5bf9e2aeff39cb5f7a9a460c458
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The ML classifier and ClamAV detection strongly indicate malicious intent. The PDF contains numerous external URIs, with one pointing to 'xezojetit.ru', suggesting it's used to redirect users to potentially malicious content. The document body is heavily obfuscated and contains metadata indicating it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=balu+telugu+audio+songs+free PDF link annotation
    • http://lemafesopeposuz.mywebcommunity.org/84851374899.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491965/normal_5fd8e039b6663.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480588/normal_5fcf9ce249fd3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447434/normal_60217eafbd092.pdfIn PDF document text
    • http://gedatidigog.sportsontheweb.net/jigumefujetitigudawone.pdfIn PDF document text
    • http://menformula.xyz/gikonunalx15ie.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457592/normal_604175cb788dc.pdfIn PDF document text
    • http://jiwimejikigigu.mywebcommunity.org/71173658456.pdfIn PDF document text
    • http://waystep.site/54923405262s51a6.pdfIn PDF document text
    • http://rejasikega.scienceontheweb.net/problem_solving_process_steps_in_social_work.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486363/normal_6024959f98eb0.pdfIn PDF document text
    • http://bilet-pdd.site/lolefubo3gcbn.pdfIn PDF document text
    • http://purpless.vip/kevifumpsrsc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wizakokowe/mito_definio_e_funo.pdfIn PDF document text
    • https://f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com/ugd/655f09_831be14d37f54c34988c45e0c5bf59b2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zolerazowubow/video_games_ps4_vr.pdfIn PDF document text
    • https://b1b0174c-961c-4936-87f6-765e1132391e.filesusr.com/ugd/6cf804_89144a00c5cc4ae1860fca730e831f15.pdf?index=trueIn PDF document text
    • https://24d1f61b-f5c5-4d2f-8180-62589f44e8d8.filesusr.com/ugd/eed56f_59d0f3017e694d8ca8706f3a537a520d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wegemebufojafak/jebibu.pdfIn PDF document text
    • https://s3.amazonaws.com/jafujasiwetid/numazilezum.pdfIn PDF document text
    • https://s3.amazonaws.com/voropa/asmaul_husna_adalah_nama_nama_allah_yang_terbaik_atau_terindah.pdfIn PDF document text
    • https://35057dd6-1d18-4acd-96c9-af3b7fddc7cd.filesusr.com/ugd/978dd5_9fea75368c3e4d558024f6d01ebf319a.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001173e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1173E 5124 bytes
SHA-256: cf4cac74d8bbd9056d6aa438f0e82b77fba1e4ee54922cde752d32d1c5cc8d8d
font_01_sfnt_off000128bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x128BC 11476 bytes
SHA-256: e95f85606100b16ad2e953f5d17aaec2b03202fddf0b5892604f1c181fcd61e2

Open this report in the interactive analyzer, or submit your own file for analysis.