Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a41016cfdb5cd90…

MALICIOUS

PDF

75.1 KB Created: 2021-04-24 00:48:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: 58595b4d5691c9da87ddbda49cfdc8e7 SHA-1: 58aed57ec1cc4c9b2ef899a666304d0c02163824 SHA-256: 8a41016cfdb5cd9087d410b9cdd5d6263cfc54bf5856911319331a6455e63c06
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, many pointing to disposable domains, suggesting a link farm or redirection scheme. The presence of external URIs and a link farm heuristic strongly indicates an attempt to direct users to malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=keurig+one+cup+cleaning+instructions PDF link annotation
    • http://nasporte1.fun/mental_health_first_aid_worksheetsa5tdb.pdfIn PDF document text
    • http://rixadixiji.scienceontheweb.net/interview_skills_workshop.pdfIn PDF document text
    • http://wativeb.mypressonline.com/63364958970.pdfIn PDF document text
    • http://vegofejolafud.mygamesonline.org/65516249922.pdfIn PDF document text
    • http://duwosolutanuz.mypressonline.com/fikonar.pdfIn PDF document text
    • http://bhd-management.space/baby_names_in_tamil_languagepv7fd.pdfIn PDF document text
    • http://kexolifowuj.medianewsonline.com/18402914858.pdfIn PDF document text
    • http://klyshsheff.xyz/certificate_of_origin_form_bahrainmj3i1.pdfIn PDF document text
    • http://topfrag.rip/63504317695e9v1b.pdfIn PDF document text
    • http://igcopyrightforhelps.com/23058880552kda99.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://vobozezojip.onlinewebshop.net/farebi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7c99026-2d61-4559-9931-ec390b7da3c0/how_to_reset_2014_prius_c_maintenance_light.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/697a5d4d-5f9e-4fd6-a5f4-7f6a9fe115c5/sheep_in_a_jeep_force_and_motion.pdfIn PDF document text
    • http://faleferesevo.onlinewebshop.net/jk_flip_flop_truth_table.pdfIn PDF document text
    • https://3c4962d9-41f7-4f14-8396-dad57cc8de20.filesusr.com/ugd/a2de88_21a39d5b145445c885a0e096a9c7dfe0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/79278e8a-1bce-450f-b037-f011dc97204f/xobegomege.pdfIn PDF document text
    • https://6d4cd3b7-91e9-43ac-92b9-205473f1e50d.filesusr.com/ugd/28146e_bd3921e816814f9fa6780cc312d52c4c.pdf?index=trueIn PDF document text
    • https://03ca3561-abfe-48ca-9b59-b1b2b77f8126.filesusr.com/ugd/1af49e_3f69f24abd9f4f5f8b1e8c6a276aa1e0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c373c44f-326a-4525-a4d6-ff36d45a0262/31132990724.pdfIn PDF document text
    • https://09af0a6c-c0e6-47ff-90c1-5b173435ccd1.filesusr.com/ugd/b92b66_19855584df4a4b3ea09019be2ff639e2.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e148695b-09a8-4dfd-a376-e6b89ad66fd1/nevus.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e850.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE850 5068 bytes
SHA-256: dafb1bc0b41451cfcfab6ea755e38315f9fc4df6764b616da5bc8b14710033cd
font_01_sfnt_off0000f9a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9A9 10408 bytes
SHA-256: 0f1ead97fa41c92d43be0b673a3da83a54b0d884f0f4bee58709e67f74e659d9

Open this report in the interactive analyzer, or submit your own file for analysis.