Malicious PDF — malware analysis report

Static analysis result for SHA-256 8eb71c33bff47380…

MALICIOUS

PDF

76.3 KB Created: 2021-03-18 07:56:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 91a75e94963aed87d04849207035ee98 SHA-1: 678baf8e1f3b4d460a139b32924126a510df1913 SHA-256: 8eb71c33bff47380713d003bcd6543c27cd0520b5c107e323db650bad7a3d486
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious intent. It contains numerous embedded URLs, many of which point to disposable hosting and are likely part of a link farm designed to redirect users to malicious sites. The document body, though heavily obfuscated, contains references to 'age related diseases pdf' and the wkhtmltopdf tool, suggesting a lure to trick users into visiting these sites. No scripts were extracted, but the overall pattern suggests a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9111

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=age+related+diseases+pdf
    • http://xevedudox.sportsontheweb.net/quran_malayalam.pdf
    • http://xajavawinereko.mywebcommunity.org/autocad_basic_commands_in.pdf
    • http://betizekaxu.getenjoyment.net/20039283121.pdf
    • http://risonubokedoxav.scienceontheweb.net/fafoxuxusidawez.pdf
    • http://jojidasusesot.sportsontheweb.net/31677334834.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vunizi/40931516551.pdf
    • https://uploads.strikinglycdn.com/files/013c7cf6-af99-4e95-94b8-0c5019a4d118/how_to_install_directv_player_on_chromebook.pdf
    • https://s3.amazonaws.com/niwotipugonuvoz/3214715545.pdf
    • http://guxejusoselota.myartsonline.com/30122749345.pdf
    • http://wotidupodugi.myartsonline.com/define_human_resource_development.pdf
    • https://s3.amazonaws.com/makumapikeze/11391325300.pdf
    • https://s3.amazonaws.com/jiwotarotavuz/82802240127.pdf
    • https://a22c3535-4c29-4f26-bf6b-1e631d3648e5.filesusr.com/ugd/28986c_d033d8ff43bb46e4b064fe5fe330899a.pdf?index=true
    • http://zodutak.rf.gd/40650334505.pdf
    • https://8d928d4c-4e32-4dc6-8093-d383c90b3cca.filesusr.com/ugd/b5d49c_00bfeb9526924fe4b9728bc0171b8421.pdf?index=true
    • http://wemaxoseni.myartsonline.com/cellist_of_sarajevo_full.pdf
    • https://uploads.strikinglycdn.com/files/2ed27064-9742-4453-98b0-9d23ebb7a936/what_are_the_skills_required_for_quality_analyst.pdf
    • https://uploads.strikinglycdn.com/files/bb446d5f-2cc5-4aaa-ac29-789cd4432007/29435319165.pdf
    • http://totawuvibewe.rf.gd/atomic_bomberman_1997.pdf
    • http://dujofaxuro.rf.gd/tefogonu.pdf
    • https://s3.amazonaws.com/viboxikuz/99349721803.pdf
    • http://kaxogesidod.epizy.com/44937568955.pdf
    • https://uploads.strikinglycdn.com/files/d6988f8e-46c7-4b20-9a83-2ed3f08e972a/english_placement_test_cambridge.pdf
    • https://807eaacf-9fb6-4e16-bcb8-061395d1d132.filesusr.com/ugd/a3ef2e_d0f22a3bc0944867b6777af7a48454e0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/28f5e6b1-c04b-45f3-91ce-16733ce7a720/how_to_fix_hp_printer_missing_or_failed_printhead.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010761.bin
4893ae6c858bdc67b01e07f8e7c7c01f95de0f492c408ad0475936213828e557		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10761 5200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.