Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b9701c886118aaa…

MALICIOUS

PDF

77.3 KB Created: 2021-03-21 12:13:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 1dca8b065e416d7b895565d17ff832e5 SHA-1: 8e99f2ce21a092b1e3921d09d170dfea8d616fdd SHA-256: 8b9701c886118aaa942f76da8b5eb54151e2fba31b7617de9eacfb5b5330bf78
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains numerous external URIs, with a notable heuristic identifying it as a link farm on disposable hosting, suggesting a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains metadata related to wkhtmltopdf and a title that could be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=how+to+use+however+and+nevertheless PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4393506/normal_5ffd81035c9a9.pdfIn PDF document text
    • https://pamaxorakumi.weebly.com/uploads/1/3/4/0/134019068/terevirewuw-momonagejo.pdfIn PDF document text
    • https://cdn.sqhk.co/nanijamu/jcDKXjb/paxolo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4462678/normal_5fe5e93daae3b.pdfIn PDF document text
    • https://suwesinorilofev.weebly.com/uploads/1/3/4/0/134096988/a35d52c0edfb.pdfIn PDF document text
    • https://cdn.sqhk.co/mixaluwekitu/heyhgig/zumbla_deluxe_mod_apk.pdfIn PDF document text
    • http://pobesegu.scienceontheweb.net/zidowubab.pdfIn PDF document text
    • http://mowefopovog.mywebcommunity.org/56374886148.pdfIn PDF document text
    • https://cdn.sqhk.co/zipirevofu/gjojghg/dawn_of_steel_base_hack.pdfIn PDF document text
    • http://kavelizopepi.mywebcommunity.org/nidiluzurimu.pdfIn PDF document text
    • https://siverogafexuj.weebly.com/uploads/1/3/4/0/134012696/bepigegunuzo.pdfIn PDF document text
    • https://pezibusogesa.weebly.com/uploads/1/3/0/7/130739584/jasotowemonireruwa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384642/normal_6042fe2a4757f.pdfIn PDF document text
    • http://ferategaj.scienceontheweb.net/51548580627.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370528/normal_5fcbb17edd947.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://wejowuwa.rf.gd/honda_hs828_snowblower_repair_manual.pdfIn PDF document text
    • http://nutagegoruzolow.rf.gd/transformarea_din_metri_cubi_in_litri.pdfIn PDF document text
    • http://lebasasasob.epizy.com/bsek_result_2019_ssc_part_1_marksheet.pdfIn PDF document text
    • http://wejajesenopezoj.onlinewebshop.net/44306894510.pdfIn PDF document text
    • http://xegeduv.rf.gd/warrior_leveling_guide_classic_horde.pdfIn PDF document text
    • http://lijowavatajo.myartsonline.com/pharmaceutical_aerosols_lecture_notes.pdfIn PDF document text
    • http://pupagerirawax.myartsonline.com/integration_of_cos2x_1ax.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE19 5028 bytes
SHA-256: 61a0f90474007f25273586f2904b8ffcb49c09d3d69e3f325cceea9973f0243a
font_01_sfnt_off0000ef3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF3C 9976 bytes
SHA-256: 6dd7a5b198ac36cd31070ee1cc11e0a1e8421c9e3d7dc0fc1da1bdbefbc093cd
font_02_sfnt_off000111b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111B4 16160 bytes
SHA-256: 53c3ec829963ec5a0af1bff4be2d724acb9959b277e5253d769434e6be684fe1

Open this report in the interactive analyzer, or submit your own file for analysis.