Malicious PDF — malware analysis report

Static analysis result for SHA-256 892ca24d9b082c89…

MALICIOUS

PDF

69.6 KB Created: 2021-03-24 21:46:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7185f04f78bba628791df2f18a043dc5 SHA-1: 75a15c129ca28dbf2c9096a97334d7eaf61c8901 SHA-256: 892ca24d9b082c8985e62384aa39b8d5036e965fcce489c0484475f815f80e68
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external URLs, many of which are hosted on disposable domains and flagged as link farms. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. The document body, though heavily obfuscated, suggests a lure related to 'BBC English class 11 literature companion pdf', aiming to trick users into visiting the malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=bbc+english+class+11+literature+companion+pdf
    • http://furniture21.online/tirutexofofb5u69.pdf
    • http://iblack.space/41159638019j8g23.pdf
    • https://cdn-cms.f-static.net/uploads/4449397/normal_603438367303c.pdf
    • http://kurs1.xyz/baixar_catalogo_eudoradotnp.pdf
    • http://vashastrahovka24.ru/108408688120l7sw.pdf
    • http://study-english-02.space/fevugoodjff.pdf
    • http://ejinaya.com/glendale_az_water_quality_reportz1apo.pdf
    • http://creditactive.info/wugegorugemigejudobomkud98.pdf
    • http://detonic-italy.website/ramsa_wr_s44248p6fk.pdf
    • http://magexaxajatadog.getenjoyment.net/bread_free_lunches_for_work.pdf
    • http://negifowutagur.mygamesonline.org/how_to_make_book_review.pdf
    • http://sovetnik53.ru/james_patterson_new_book_texas_outlawau4os.pdf
    • http://sugalomiwuto.getenjoyment.net/esl_adjectives_and_adverbs_worksheets.pdf
    • https://cdn-cms.f-static.net/uploads/4480155/normal_60569256cb483.pdf
    • http://qwert-ita.fun/giripoxemukerik2eqae.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/35af61d2-db10-4100-bea4-462808b83233/69389167417.pdf
    • https://s3.amazonaws.com/nazekisigiduz/does_chick_fil_a_give_free_breakfast.pdf
    • https://uploads.strikinglycdn.com/files/310867e7-3c69-42c4-a05d-d12e2ebe607d/the_little_prince_movie_with_english_subtitles.pdf
    • http://sanojepenot.onlinewebshop.net/54507365818.pdf
    • https://s3.amazonaws.com/gopuze/16857749256.pdf
    • http://saluwagasa.onlinewebshop.net/sedoretisakepokoko.pdf
    • https://s3.amazonaws.com/tesasubawalozan/xazobebojinanenomona.pdf
    • https://uploads.strikinglycdn.com/files/93891865-ee00-4cbb-81ad-5e426b9660fa/why_are_germinating_seeds_used_in_the_investigation_of_respiration.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c834.bin
f613519990dc3d6bec01b395d0ffa4421cfe01228dbd975135a086324235367f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC834 5808 bytes
font_01_sfnt_off0000dbcb.bin
befe86f2e9182c7f8135518b94c1ca1a9c8a9a9a6f5fec12d9bc7402366ce87a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBCB 2004 bytes
font_02_sfnt_off0000e562.bin
91f7b284467ca7b492cd8145fb003c8fd7ada7c3a0a81a5bcb96d3c1ddb542f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE562 10256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.