Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a9f13ad21572b93…

MALICIOUS

PDF

79.3 KB Created: 2021-03-15 13:51:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 5ec49eb7d8493650c7172a8dc26d88b8 SHA-1: 039939eff928903310881a4102669217613db10f SHA-256: 8a9f13ad21572b930a54ff6bd2aa340689c373076564b03b2b9d344d7cc901c1
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, identified as a link farm on disposable hosting. Heuristics indicate this is a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=el+juego+de+la+oca+board+game PDF link annotation
    • http://ramuwesitavoz.mywebcommunity.org/72936803999.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485001/normal_601ef241c0a24.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413125/normal_5fc7ede5e834e.pdfIn PDF document text
    • http://xijipeva.mypressonline.com/xojexagalukafes.pdfIn PDF document text
    • http://meletemobu.iblogger.org/lonexigowexipuvutajixubo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/749a267a-5196-44af-a69a-86bbb22f6be2/pakumudelazoxepelo.pdfIn PDF document text
    • http://vamavaremimot.atwebpages.com/dolotodizu.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/macbeth_shakespeare_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80e35901-1557-4c79-8280-14a9ed62d10e/nokuzilojerujokajokevabud.pdfIn PDF document text
    • https://s3.amazonaws.com/jipowumat/what_type_of_engine_does_a_toyota_corolla_have.pdfIn PDF document text
    • http://tepobibofa.epizy.com/national_hypertension_guidelines_jnc_8.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95db20e7-5a75-4c60-8042-cccee692fdeb/how_to_install_brackets_on_ge_dishwasher.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ee87867-0a11-4364-98f8-7e00233e1c16/dixomurelu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a376734c-7608-4488-8378-9036815f412a/88739374795.pdfIn PDF document text
    • http://wofogadopa.rf.gd/azur_lane_formidable_build.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24cb3972-701e-4462-b032-94ef782049fd/how_do_you_program_a_regency_fireplace_remote.pdfIn PDF document text
    • http://wejajesenopezoj.onlinewebshop.net/duwoviwulekivisori.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c77138f-52a5-480b-b091-ef7efea63b13/kenmore_elite_washer_maintenance_manual.pdfIn PDF document text
    • http://vafitinupisojud.onlinewebshop.net/20663390404.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/907fded9-295a-4d38-9726-9c4ebb897b1d/sagavowoxaxuvemapezeze.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fef8a18d-9a64-4d45-b6d6-d1b9e751e417/70349061655.pdfIn PDF document text
    • http://xiruzila.rf.gd/calculer_le_taux_de_variation_formule.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f733.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF733 5252 bytes
SHA-256: 83c38081458972dba74c97e649c6eeef622ff8410a1103ff4a6d07caf687c8ad
font_01_sfnt_off00010902.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10902 11900 bytes
SHA-256: 851440b613ce0ee8395b83a472e26536f27a87e0e44325e51d411b259ac647c5

Open this report in the interactive analyzer, or submit your own file for analysis.