Malicious PDF — malware analysis report

Static analysis result for SHA-256 8300a4445637912c…

MALICIOUS

PDF

114.3 KB Created: 2021-03-03 22:55:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 97338017bc6565336160459e03f3d90b SHA-1: 71bc677f082c3a5df1ac1fe2691e4a7ec3bcc2d5 SHA-256: 8300a4445637912c5a1998da3394439f7449824740ec387a5522b30979683fce
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with one specifically targeting 'pearson education math worksheets grade 5 pdf', suggesting a lure for educational content. The PDF's structure and the presence of external URIs point towards a phishing or redirection attack, likely to serve a second-stage payload or collect user information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/wix?keyword=pearson+education+math+worksheets+grade+5+pdf PDF link annotation
    • https://cdn.sqhk.co/zesunotu/jaqbhcz/kenileteteripudemudiw.pdfIn PDF document text
    • http://itash.space/nolakam7451.pdfIn PDF document text
    • https://vipogonegope.weebly.com/uploads/1/3/0/9/130969266/a7c50447dee8d1.pdfIn PDF document text
    • https://cdn.sqhk.co/mokevesin/ahhjihN/free_ringtone_android_imperial_march.pdfIn PDF document text
    • https://gazotudigexeb.weebly.com/uploads/1/3/1/1/131164446/lidanib.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453734/normal_6021555a0cc65.pdfIn PDF document text
    • http://womafogexuko.iblogger.org/emergency_medicine_physician_assistant_jobs_california.pdfIn PDF document text
    • http://kubarabonexomi.iblogger.org/aoac_966._23.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416149/normal_5fe70b8f34d20.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451556/normal_5fccf520cb2a9.pdfIn PDF document text
    • https://xofusifusu.weebly.com/uploads/1/3/5/3/135312872/3075097.pdfIn PDF document text
    • http://axecheat8.xyz/attack_on_titan_live_action_part_2_full_movierth8j.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453134/normal_5ff8a7d7066a1.pdfIn PDF document text
    • https://jadowusirufire.weebly.com/uploads/1/3/2/7/132740355/fbb11b2e7af3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/xamibebulosaxug/maple_leaf_ragtime_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/nefunupu/pokuvuluwiminatarape.pdfIn PDF document text
    • http://xeravujowa.epizy.com/53272680557.pdfIn PDF document text
    • http://dukuzuwikisos.epizy.com/56653241192.pdfIn PDF document text
    • https://s3.amazonaws.com/kovibu/14380639344.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017546.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17546 5700 bytes
SHA-256: 78dd7040656ccc682c3dd174414c2bbf4af47127b098e4034abc35616d0f3aea
font_01_sfnt_off00018898.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18898 10840 bytes
SHA-256: 388a6ea18422314306486d1e391c3c5f903553fd0b2d5f3f15223e29ab8694de
font_02_sfnt_off0001ad41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AD41 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.