Malicious PDF — malware analysis report

Static analysis result for SHA-256 853bfdcb5d5e99d1…

MALICIOUS

PDF

84.0 KB Created: 2021-03-18 18:04:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b0de11cfb47c6dc020b49facaed60b73 SHA-1: 96f253e5b4cb42a78b97db206b06a20a2f182261 SHA-256: 853bfdcb5d5e99d145bdfdffb6df37732637b1ad4db56910d074bf872f03de0f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The presence of numerous external URIs, many pointing to link farms on disposable hosting, suggests a phishing or malware distribution campaign. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=black+and+blue+background+free
    • https://cdn.sqhk.co/kubafipefo/fjghijf/jagatawatalisulof.pdf
    • http://respect-ltd.su/nexasopejilam6sas0.pdf
    • https://cdn.sqhk.co/rolidofajug/gi88adv/zetilaniv.pdf
    • http://stroy-level.ru/pubumuzumajunejilufumyumqx.pdf
    • http://tasigezagu.scienceontheweb.net/business_administration_free.pdf
    • https://cdn.sqhk.co/dilobowuz/jbnXqjb/vi_command_add_to_end_of_line.pdf
    • http://ezfix.asia/gotadukavaha9t2.pdf
    • https://cdn.sqhk.co/genamudazunu/e0jKKia/vutegunikegaruruxebovab.pdf
    • http://gakukuketisalum.scienceontheweb.net/gadojosotasekunimira.pdf
    • https://cdn.sqhk.co/tevimuwijile/pAhfihX/classroom_rules_for_middle_school.pdf
    • http://jusibebobekig.iblogger.org/el_diario_de_greg_1_espaol_latino_pelicula_completa.pdf
    • http://rupaduwovuw.getenjoyment.net/engineering_drawing_orthographic_projection_examples.pdf
    • http://drilltech.info/yugioh_legacy_of_the_duelist_deck_guidev257a.pdf
    • http://pazadixokumox.sportsontheweb.net/basic_probability_questions_with_solutions.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ca4a8aaf-28c8-4acb-b125-23174bde9af8/2491636579.pdf
    • https://247e77cc-5367-4382-8586-7c5891409f42.filesusr.com/ugd/2dbf5a_bb80c50a7f7541b4a03e91c220976fda.pdf?index=true
    • https://c31d65df-273c-4bcc-acfb-7b03b0724b99.filesusr.com/ugd/e7e4a0_c8f7064dc42f4621a782ace928358546.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3c7c5330-5df3-47c6-b078-493fee78f0ab/why_human_experimentation_is_important.pdf
    • https://uploads.strikinglycdn.com/files/000e7300-91dc-44e4-a02c-0907fb52b1ce/31105514990.pdf
    • http://bofiragomux.rf.gd/jajuginomemoruwem.pdf
    • http://letedimakomewop.epizy.com/87892654398.pdf
    • https://69868269-04aa-4a0d-8379-1371762fd556.filesusr.com/ugd/d8beff_a94aae9e962446d5a8b1e5a53cc36bc5.pdf?index=true
    • http://rawonuruked.rf.gd/navy_blue_wool_coat_ladies.pdf
    • http://pewaxoxepizus.rf.gd/gavutezavisi.pdf
    • https://uploads.strikinglycdn.com/files/b4586440-d0ed-415f-ac94-07fbc52fcff8/60035258903.pdf
    • https://uploads.strikinglycdn.com/files/3376cc70-dd6e-4822-b518-a559d91bb55b/ruud_achiever_water_heater_manual.pdf
    • https://1dab3517-3db0-43ff-9fd6-b65b51f65b60.filesusr.com/ugd/565485_fb65face1e6744c7a208b78e19024a3d.pdf?index=true
    • https://4bf641bf-117a-4913-931f-55e49063997f.filesusr.com/ugd/5befcb_baa4b413b3834e0db86b20b0933c0986.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f507.bin
03d1722df94528523143befa95a8310cf4846caca07c53315cc619e6e42fa848		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF507 5264 bytes
font_01_sfnt_off00010702.bin
d6da7dac21e33c85a72498a8b32befe81d9e92262fb1302593f2244b1b54d890		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10702 11100 bytes
font_02_sfnt_off00012cce.bin
3afbc95f4a2677bf4c8b77bd7df62e4dbeb651db4b5e482cf97b58e472170d58		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CCE 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.