Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c1df02d3ee2251a…

MALICIOUS

PDF

78.0 KB Created: 2021-09-14 06:44:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: fb30e8416234ff92eebad5be69e1ccae SHA-1: 132a95b61552f39f2d0ce9c629967fa2bf58aab2 SHA-256: 8c1df02d3ee2251aeeaaf42b84b4df91e5599643259d94deb82adafa959f6e21
134 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and is flagged by ML classifiers and ClamAV as malicious. The document body is heavily obfuscated, but the presence of numerous external links, many on disposable hosting, suggests a phishing or malware distribution attempt. The embedded JavaScript likely facilitates the execution of malicious actions or redirection to these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9973

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/uplcv?utm_term=telecharger+navigon+android
    • http://herborgthailand.com/file_media/file_image/file/73441388453.pdf
    • http://nenorm.com/files/files/57161788038.pdf
    • http://xn--80adic7alej3d.xn--p1ai/userfiles/file/dulosaxiwubete.pdf
    • http://tractortools.cz/ckfinder/userfiles/files/pajawokalonenixezemuje.pdf
    • http://jadeite.ru/images/file/nodur.pdf
    • http://thecountryclub32055.com/userimages/mugewetudegisusatukexe.pdf
    • https://santa.sg/images/users/00000000/files/20499151161.pdf
    • https://www.infratechgroep.nl/wp-content/plugins/super-forms/uploads/php/files/77b618cb77d45919cfec8ed692a878f9/84980604304.pdf
    • http://www.chubsorn.com/file/files/kizofurejig.pdf
    • https://pecintajp.com/contents/files/tidid.pdf
    • http://ekstelekom.com/userfiles/file/45292898313.pdf
    • http://ohana1bbq.com/uploads/files/10788218066.pdf
    • http://hunting.kg/userfiles/file/60666553732.pdf
    • https://gtnet-engine.com/ckfinder/userfiles/files/sazilimewevevokoj.pdf
    • http://shbaicun.com/userfiles/file/2021090608225473499.pdf
    • https://avistravel.activsport.ro/userfiles/file/36943683664.pdf
    • http://gestaocipa.com/public_html/Imagens/file/95343848588.pdf
    • http://www.alliance-bio.com/user_data/editor/ckfinder/core/connector/php/upload/files/kagodobokuguzabipogekuvor.pdf
    • http://cppzone.ru/users/blogs/file/talutaxisimaguzumuvudizi.pdf
    • http://pferdefreunde-brueckenhof.de/sites/default/files/userfiles/file/69105999040.pdf
    • https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/161347dc4537a6---28119176018.pdf
    • https://imahima.xyz/js/ckfinder/userfiles/files/nonobuzokesi.pdf
    • http://rungruangsteel.com/public/upload/userfiles/files/telunejugeta.pdf
    • http://pandoraecza.com/genelresimler/file/lejawuji.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbda.bin
bfa61db88b865bb886c24bb6d45cb924a72e1c1433c80da97a6dd8adeb0677e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCBDA 18328 bytes
font_01_sfnt_off0000fae2.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAE2 16792 bytes
font_02_sfnt_off000112f9.bin
861763b9f6b034af73710c3a82435db341c4b934f353b61dadc26f2aa1700cd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112F9 10412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.