Malicious PDF — malware analysis report

Static analysis result for SHA-256 81289f81d492d9e3…

MALICIOUS

PDF

70.3 KB Created: 2020-11-30 12:45:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ae0400d955429146887fa4259d68b5ad SHA-1: 4112d9c6d1e3739398e5aefbc78b78fd548195e9 SHA-256: 81289f81d492d9e3d4843ba661fbf975726f47c574fe2e77728f812c6970e273
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, suggests a lure related to 'free phonics story books'. The presence of a malicious redirector URL and the ML classifier's high confidence score indicate a phishing or redirection attempt. No scripts were extracted, but the PDF structure itself facilitates the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=free+phonics+story+books+pdf
    • https://doduvubilomav.weebly.com/uploads/1/3/4/8/134861128/lasoru-tetenelule-bireselelawome-gugivufo.pdf
    • https://wizamivakujeji.weebly.com/uploads/1/3/4/5/134526499/2b96f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe328d9d79364840591983/1606300303750/82107328617.pdf
    • https://static1.squarespace.com/static/5fc2f572e9fc3622d52f966f/t/5fc4b56b3485235c865b0841/1606727024477/get_lucky_bass_sheet_music.pdf
    • https://static1.squarespace.com/static/5fc006d0104edf1d777bfbd4/t/5fc3098f5147b14804973709/1606617488566/dragon_bloodstone_healing_properties.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4fe464571256543146cf/1606373348923/68220503573.pdf
    • https://static1.squarespace.com/static/5fc0e2ed17e7202640ea1bf0/t/5fc21e12fa04221c71679ede/1606557203849/denotaju.pdf
    • https://s3.amazonaws.com/taguxif/goxesedenomudezijavo.pdf
    • https://s3.amazonaws.com/jobavo/61729236029.pdf
    • https://s3.amazonaws.com/wizuluworafid/95429357615.pdf
    • https://s3.amazonaws.com/fedufiporara/slide_glide_gun.pdf
    • https://static1.squarespace.com/static/5fc0e627116eb00e3c4beed8/t/5fc155f25147b14804653c7f/1606505971059/53526582035.pdf
    • https://static1.squarespace.com/static/5fc006d0104edf1d777bfbd4/t/5fc1c4eff81c9a2a0ce3a457/1606534385469/1999_jeep_cherokee_sport_owners_manual.pdf
    • https://static1.squarespace.com/static/5fc38bc62bbd7406581738ad/t/5fc4756a3c6ccf69f3edf9da/1606710634423/pima_county_attorney_candidates.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c8d7.bin
85cb21b8bb909e7b515359fdacae619d218544e3d31b7466949a1a2576af11f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8D7 5052 bytes
font_01_sfnt_off0000d9fd.bin
d73deb103899e9cac5d0516e3293095139f914b874897a2320be32a88d0d3a8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD9FD 10724 bytes
font_02_sfnt_off0000fe9c.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE9C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.