Malicious PDF — malware analysis report

Static analysis result for SHA-256 894fb431dbe97234…

MALICIOUS

PDF

80.7 KB Created: 2021-05-15 11:54:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: d3f9f19224dec4620ff8427d448f6fe1 SHA-1: 8071b250dae842c7d797bedbfdaec684553f55a1 SHA-256: 894fb431dbe97234b0cc639132a7cb86022581538785a102c45f6b833eed3948
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to suspicious domains and redirector infrastructure, indicating a link farm designed to lead users to malicious content. The ClamAV detection and ML classifier further support its malicious nature, classifying it as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to deliver a malicious payload or redirect users to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=does+the+second+amendment+only+apply+to+militias In PDF document text
    • http://hookup681.site/801099832088si9u.pdfIn PDF document text
    • https://cdn.sqhk.co/mogezunir/jghfgdp/recargar_a_cuba.pdfIn PDF document text
    • http://tiruxukanemaga.iblogger.org/gakufabekesub.pdfIn PDF document text
    • http://mkuu.club/bseb_intermediate_result_2018_with_marksheet4h0ly.pdfIn PDF document text
    • https://cdn.sqhk.co/rukefazox/tjcgSjd/94205130557.pdfIn PDF document text
    • https://cdn.sqhk.co/kuzetuzame/igbiiOK/guess_the_emoji_movie_answers_level_43.pdfIn PDF document text
    • http://sy0n.icu/various_daylife_apka1k4q.pdfIn PDF document text
    • https://cdn.sqhk.co/toliximozupa/Khheegc/donde_descargar_mi_factura_at_t.pdfIn PDF document text
    • http://mexicotop3.xyz/nevinaturi05imi.pdfIn PDF document text
    • https://cdn.sqhk.co/wujozuzewed/hf2gdbx/oklahoma_lottery_scratchers_winners.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://wugezirux.epizy.com/zuzime.pdfIn PDF document text
    • https://5b3fc17b-a4fb-4144-9a53-ff617e35bc6a.filesusr.com/ugd/696117_77ae66983d3c45729345c24907cfacd6.pdf?index=trueIn PDF document text
    • https://12a3aa02-022d-4218-8efb-90aa4388683d.filesusr.com/ugd/6dfd9b_e3e9f77cfd1a4c77b35296429f965d35.pdf?index=trueIn PDF document text
    • https://c7f0abc7-d23b-482d-bd16-0771495bb668.filesusr.com/ugd/bb13a2_5d79e5db76f34c928611e268b24dd4f3.pdf?index=trueIn PDF document text
    • https://c779a0a5-5a96-4308-8c37-720837e0bdd2.filesusr.com/ugd/4f1d02_268021b91cec49cea76aa88a718792f0.pdf?index=trueIn PDF document text
    • https://13a2bf7a-7930-4518-a7e6-737bf3c0aa4f.filesusr.com/ugd/f5c1a0_6827eb9b07b64722bd01036a588e87f2.pdf?index=trueIn PDF document text
    • https://d1ee23ee-9ccf-45b0-80ef-1e1ff1f657c4.filesusr.com/ugd/9ef0c3_34eac7720b254069a28c411ec5997f22.pdf?index=trueIn PDF document text
    • https://40785fcd-1e5e-4316-9306-5db1d5795eae.filesusr.com/ugd/2f07a1_53c0814f74a74492a1b6de7ab6fc0f36.pdf?index=trueIn PDF document text
    • https://79f67b98-100a-41ac-8a2f-4880133f117e.filesusr.com/ugd/f12c90_795fd5a0e3764150965d1795444b098a.pdf?index=trueIn PDF document text
    • https://0b609444-e5a2-4a7e-9779-a3c6bae51a53.filesusr.com/ugd/529dbf_e457ad7d1f4b4e3697e8423eaade46a7.pdf?index=trueIn PDF document text
    • https://6b21c484-99f8-4e97-b77a-b77c054bfe5d.filesusr.com/ugd/f139d4_afba143e0ca44feebf829a356780bb1d.pdf?index=trueIn PDF document text
    • https://828c6a01-da61-4814-986a-f72e64f4f334.filesusr.com/ugd/cdfdba_5f64fd46b6a14ec2aed0b1e483a13d3d.pdf?index=trueIn PDF document text
    • http://luvugotanufulav.epizy.com/gerizevatabovagag.pdfIn PDF document text
    • https://33c7e2ec-32fc-4676-a642-9d95a4379e01.filesusr.com/ugd/622218_8f16f3400a94422896d1dc96a522830b.pdf?index=trueIn PDF document text
    • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_6fd87c99eaf74caea4a0be223aee873b.pdf?index=trueIn PDF document text
    • http://luremugaxufarup.epizy.com/fijixanago.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB88 5316 bytes
SHA-256: 9a52ac3bf0f626eee654da5e74ac41daf59453692b61ad129ccea181c0851682
font_01_sfnt_off00010d8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D8A 11068 bytes
SHA-256: 7f01c673c7efff7f8627c0a37e68c2d5d38865ac8874b3d4851b15f346fa8a51

Open this report in the interactive analyzer, or submit your own file for analysis.