Malicious PDF — malware analysis report

Static analysis result for SHA-256 9092b0918ecfc196…

MALICIOUS

PDF

106.9 KB Created: 2021-04-02 11:48:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 760d5f29c69dc93a8d67a27526c42576 SHA-1: e293958ca61b20469dd9fa8dae2fb59451f22c97 SHA-256: 9092b0918ecfc19638c512fcacdf0e1b492c7ebf338e68fccd760bdba80eeefa
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a link farm, indicating a phishing or malware distribution attempt. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the sheer volume of suspicious links suggests the primary attack vector is directing users to external malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/123?utm_term=aoe+1+ban+chuan In PDF document text
    • https://cdn.sqhk.co/xemuxebu/siihhjc/4056926264.pdfIn PDF document text
    • https://sozejaras.weebly.com/uploads/1/3/2/6/132695734/3224980.pdfIn PDF document text
    • https://mazakodavowur.weebly.com/uploads/1/3/4/3/134335882/polaxamovomam.pdfIn PDF document text
    • https://reropazorulofo.weebly.com/uploads/1/3/4/4/134437501/navitujewedod-gopekubonopuji-mosavomoraji-memaluwojikuz.pdfIn PDF document text
    • https://forinuvu.weebly.com/uploads/1/3/4/8/134871535/babonadasuwove_zejume.pdfIn PDF document text
    • https://cdn.sqhk.co/ketalidukepi/5bijgdK/klondike_adventures_wiki_deutsch.pdfIn PDF document text
    • https://cdn.sqhk.co/wejupexuput/ejchiUj/dodge_dart_rallye_rims.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vinivuxo/bsnl_186_plan_kerala_sms_format.pdfIn PDF document text
    • https://s3.amazonaws.com/xijalovelokolep/osha_safety_standards_for_manufacturing.pdfIn PDF document text
    • https://s3.amazonaws.com/zewimu/microbial_biochemical_tests.pdfIn PDF document text
    • https://5d3a3edc-1384-4eb0-a354-174dd54c13aa.filesusr.com/ugd/7f5dc5_c4f8e5ae7e5e4d98b659934bbc7104f1.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/11e78618-800d-436a-9b0e-0c3fb940062a/ccna_security_exam_sample_questions.pdfIn PDF document text
    • https://69f1164a-dcd3-4310-9fb4-3b67f03bdbb0.filesusr.com/ugd/9d7282_303170fb05e94ea0a0c22a9495fd4ec5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1bc35d23-3575-4eba-b250-04248758db47/how_much_does_it_cost_to_lift_a_pt_cruiser.pdfIn PDF document text
    • https://ab737b70-891a-4a1f-8db9-ee548211cb31.filesusr.com/ugd/ce14f3_f494c2ea0d094c088a35c99b8cb01ec2.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb259ec7-84b4-427d-a15e-718b48ce7803/vomovazesikoxixosole.pdfIn PDF document text
    • https://s3.amazonaws.com/babuxufarizuxur/coordinating_and_subordinating_conjunctions_exercises_with_answers.pdfIn PDF document text
    • https://254a6a59-343e-4b7e-907c-c4819e171fff.filesusr.com/ugd/decf6f_9bee997241ef4484ade08d612a464fb1.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.orgIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC1B 6632 bytes
SHA-256: 63f0f1496310f6bd71068dd3f9e152f0ae8aca22568fdd4ce3e1c1e4320c994d
font_01_sfnt_off0000fc83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC83 4720 bytes
SHA-256: f3e0d24c2876362ccbca893d870fd10d90f9d7c430d13c368a9062c7ce121b16
font_02_sfnt_off00010cf6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CF6 4760 bytes
SHA-256: c935de8359a1f94590c02aec863dffa3f557457c76120f08bf4eee7f02902396
font_03_sfnt_off00011d28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D28 1800 bytes
SHA-256: 65c4c5c0631e73087c15a5b8295a7ed29429ec7a28bee8cfeea2ddd4fe38cea1
font_04_sfnt_off000125f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125F7 36180 bytes
SHA-256: cc74a16043a688c1bd00cae768cdad32168970a69e994081bbe1106438ae1a12
font_05_sfnt_off000179ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x179EE 16188 bytes
SHA-256: dfddcdd1e2747f939f1a98167a1be694f5f5680d19caf665c78554f08f7189e4
font_06_sfnt_off00018f4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18F4E 3720 bytes
SHA-256: b5f98540b24198d418741fe33651e4710b19f7fa7412385e20b8ddefdc286ef5

Open this report in the interactive analyzer, or submit your own file for analysis.