Malicious PDF — malware analysis report

Static analysis result for SHA-256 880d994679a3e991…

MALICIOUS

PDF

92.2 KB Created: 2021-09-10 14:21:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 01a59018e8d33dc1efd736178dc199ba SHA-1: 1913e268b7dd63863250f03e72a6d209b68b85b1 SHA-256: 880d994679a3e9919b0f6f00ece7bf66d6e19c5dc9b0e3b5cfe70ea7926b462d
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous links, many pointing to disposable domains, and one URL in particular, 'https://elitestrategyglobal.com/.../89962377660.pdf', is identified as a link farm. The document body is heavily obfuscated, but the presence of external URIs and the link farm heuristic suggest a phishing or malware distribution attempt, likely disguised as a game download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9558

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://elitestrategyglobal.com/wp-content/plugins/super-forms/uploads/php/files/818b40fb82c205498b38d18d14c093e0/89962377660.pdf
    • https://www.restaurant-latableedevercel.com/ckfinder/userfiles/files/51173748046.pdf
    • http://pphu-joanna.pl/fckpliki/file/bexusafevamazezes.pdf
    • http://guowangcable.com/d/files/vuvatebewozirizosaz.pdf
    • http://www.s4b.nl/upload/files/leseri.pdf
    • https://officialbacknumber.org/editor_up/nugomojomi.pdf
    • http://chandigarhdatarecovery.com/files/file/96052441541.pdf
    • http://zsdbiopharm.com/upload/files/kexapuk.pdf
    • http://ttworld.hu/uploads/content_files/files/41386633392.pdf
    • http://www.armstrongre.com/files/files/pedorewiwepejatizogaduf.pdf
    • http://exito-opakowania.pl/userfiles/file/29944061168.pdf
    • http://exima.kr/userData/board/file/24201009725.pdf
    • http://elitvorota.ru/f/file/zesivonapijokunudoki.pdf
    • http://ip-malkov.ru/uploads/files/43734072229.pdf
    • https://nanyangtextile.com/userfiles/file/66903338220.pdf
    • http://superazs.ru/images/news/file/10829759446.pdf
    • http://escolacaritas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613352044f2cb---5306680741.pdf
    • https://khabul.mn/mmpa/userfiles/files/nujifiketesudabupuvobi.pdf
    • http://stavo-bazar.cz/userfiles/file/nitofag.pdf
    • https://rumputhijau.com/contents/files/nulipafajivawotijutok.pdf
    • http://jumpinfit.it/userfiles/files/xoseret.pdf
    • https://emprenderem.cl/files/48971584955.pdf
    • http://cameradungphat.com/uploads/files/wuxofizesilakefatuwop.pdf
    • http://web-news.eu/www/pkpar/userfiles/file/bafiwenazelolinuk.pdf
    • http://hytechplus.com/userfiles/file/48791289868.pdf
    • http://osayit.com/images/file/65902935082.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=madout+2+pc+game+download
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000defd.bin
1d5ef4a3482cecd67f90b56e16b9dccbe6d9334cefcfd1373d3d6490a7018dc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEFD 18152 bytes
font_01_sfnt_off00010dde.bin
97a693020a9c67c913fa5abf5d83a61848c846aa130c5182d8e66f233602b60d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DDE 2044 bytes
font_02_sfnt_off00011727.bin
2b7310ccd218a29eb0c8751da6165bd5dfc0efa9c9c9ec64cc3710bc71957776		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11727 17468 bytes
font_03_sfnt_off000131a4.bin
75d9b12392af1ef1fa2900659786f5a3e8edea9a45ebb1834fdd02323f715171		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131A4 10796 bytes
font_04_sfnt_off00014a6e.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14A6E 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.