Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f9abc08b0f3d14d…

MALICIOUS

PDF

68.8 KB Created: 2021-03-08 15:37:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-04
MD5: 4bad72bd6ccfded24e16bd112baa13ed SHA-1: abc20e9158f6ffa4103f4b5224072d07fefded9f SHA-256: 8f9abc08b0f3d14d17c02bba467c75e0b89c71ed759221d7852c0962b6f21dcc
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=summer+cookout+clipart PDF link annotation
    • http://namsinc.info/cmo_se_calcula_la_normalidad_de_una_solucinesplb.pdfIn PDF document text
    • http://prod-fruit.space/electronics_all-in-one_for_dummiesia0eu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4530990/normal_6009be1c2fdc9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463277/normal_6009fe78211ba.pdfIn PDF document text
    • https://cdn.sqhk.co/takoxuwal/tFAjdii/mini_speedy_bag_lv.pdfIn PDF document text
    • http://moxegagiku.22web.org/17864549805.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479715/normal_5fe32d5a7dc5f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485004/normal_5ff6555858e9b.pdfIn PDF document text
    • http://decideyouself.fun/97859689807higs7.pdfIn PDF document text
    • http://wspring.space/folktales_worksheets_for_first_gradeyf1jd.pdfIn PDF document text
    • https://cdn.sqhk.co/lagidexetin/gbgjf0W/27844023009.pdfIn PDF document text
    • https://cdn.sqhk.co/komagiju/v5gjheF/42995978947.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ec47204-681d-46d3-83df-635abf0d0e0d/miele_dishwasher_repairs_near_me.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21c8c7c2-3266-4ae8-9758-993ae238f1c3/merkury_wireless_bluetooth_headset_v11.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e34f82a1-f19c-4878-9fb0-d0afac7bb855/eyelash_extension_client_information_form.pdfIn PDF document text
    • http://ravuxigud.epizy.com/zizegonikeb.pdfIn PDF document text
    • https://c31d65df-273c-4bcc-acfb-7b03b0724b99.filesusr.com/ugd/e7e4a0_35afafb4915c4bc6b0ef927f1016225a.pdf?index=trueIn PDF document text
    • https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_20b93709aca4432c94c0462f7fde449c.pdf?index=trueIn PDF document text
    • http://sakigekoxigukil.epizy.com/penafasoxo.pdfIn PDF document text
    • https://7f2467c6-0d80-4e38-8df7-27624e0b9669.filesusr.com/ugd/e19533_236e0afb7fae4342a47f430107df9a97.pdf?index=trueIn PDF document text
    • http://jaziwovapotulit.epizy.com/long_term_debt_balance_sheet_meaning.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d17f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD17F 5068 bytes
SHA-256: e5bcacd02def8e47472367fecc8c0ccbe18cba9ef9a92b68edd8736db894a8ee
font_01_sfnt_off0000e2aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2AA 10472 bytes
SHA-256: 9a385f1444820e5c01e3041337933398b17d5c159bd6a4702b4cf793a75fb3bf

Open this report in the interactive analyzer, or submit your own file for analysis.