Malicious PDF — malware analysis report

Static analysis result for SHA-256 90164ef7400e83dc…

MALICIOUS

PDF

83.4 KB Created: 2021-03-17 18:13:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: 7a8f987f65fa819f8c3a4fc11a835310 SHA-1: 2871aba51fc8c6b730dd0366fb55ac7cbf2c0dae SHA-256: 90164ef7400e83dc27b4b6424fd5d3fa92f3e541c79122cf5cbc3aff774281e5
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URL that redirects to a suspicious domain, likely intended to host a malicious payload or phish for credentials. The document body, though heavily obfuscated, appears to be a lure related to a common search query, suggesting a social engineering tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=what+does+the+bible+say+about+being+mad+at+your+husband PDF link annotation
    • http://bonus332.site/kaligesamorumotebufepg6yp.pdfIn PDF document text
    • http://fukijuwevo.getenjoyment.net/fojogozejaxovusazuxom.pdfIn PDF document text
    • http://dorightpress.com/forest_exam_answer_key_linkzhmpb.pdfIn PDF document text
    • http://waferaboteb.mypressonline.com/britax_marathon_clicktight_forward_facing_height_limit.pdfIn PDF document text
    • http://chatik85939775.fun/bissell_big_green_deep_cleaning_machine_carpet_cleaner_86t3_kohlshwgsu.pdfIn PDF document text
    • http://zokupez.mygamesonline.org/lunipuvas.pdfIn PDF document text
    • http://jekefidaz.mygamesonline.org/fedoxojig.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://d102a0f2-001f-4998-bb0a-88ac30ac05b5.filesusr.com/ugd/771ea4_97b93efe449b45f5a50418347e544a8e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2c00d7a-83b1-488a-a542-e13fcf3ce2b0/janefen.pdfIn PDF document text
    • https://fac30f9c-1bc3-4ff6-ac40-7ced1d2a170b.filesusr.com/ugd/3b7182_6d9f2ec01b904b6783d289bc907aa3ef.pdf?index=trueIn PDF document text
    • http://pesetunal.onlinewebshop.net/book_review_sample_for_high_school.pdfIn PDF document text
    • https://dfa52777-3edb-460f-9b14-ca5101cd4ecc.filesusr.com/ugd/5360f8_2afb6a98dc4949b28e31e5027c904f51.pdf?index=trueIn PDF document text
    • https://b6086c54-8ef4-40f3-ba18-bbbb993b339e.filesusr.com/ugd/36e927_fd055f2b983048489da5b72050ef80cc.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7dbac680-25eb-474e-8d64-02208e9d0cea/45726514232.pdfIn PDF document text
    • https://931f52e6-cb68-4a93-8e02-54808d33f8b6.filesusr.com/ugd/6290de_2f54e386047d4c078953b2a55122886d.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010807.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10807 5496 bytes
SHA-256: 2819f6828e513bf37cf1b35bbc3e3fc06079038a1089ba926406b399f9b2aea0
font_01_sfnt_off00011a9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A9E 11160 bytes
SHA-256: 219537e39eb8e665682a9afd2c1606e6b826c132cb583374a7651ed2a872a93c

Open this report in the interactive analyzer, or submit your own file for analysis.