Malicious PDF — malware analysis report

Static analysis result for SHA-256 925b9240163f063d…

MALICIOUS

PDF

147.8 KB Created: 2021-04-04 19:36:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: cbc36180696c130100f33e83eb82b81e SHA-1: d99df647be526b1cfa22b9caba8ded3a5a401b73 SHA-256: 925b9240163f063d8cf29e20ff54a1925a3148544a352640bb41e8cd9aa954b5
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links designed to redirect users to malicious infrastructure, specifically identified by the 'PDF_MALICIOUS_REDIRECTOR_LINK' heuristic. The primary malicious URL observed is 'https://crophysi.ru/award?keyword=artificial+neural+networks+theory+and+applications+pdf'. While the document body is heavily obfuscated, the presence of numerous links and the critical heuristic firings strongly indicate a phishing or redirection attempt, likely to deliver a secondary payload or lead to a credential harvesting page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=artificial+neural+networks+theory+and+applications+pdf In PDF document text
    • http://bopikifej.22web.org/list_of_penny_stocks_on_robinhood.pdfIn PDF document text
    • http://kobodesuwid.getenjoyment.net/maze_runner_characters_personality_types.pdfIn PDF document text
    • http://sibatike.getenjoyment.net/73581006169.pdfIn PDF document text
    • http://jinosewifuwefe.22web.org/xelapivikalep.pdfIn PDF document text
    • http://tofotibuwul.sportsontheweb.net/nebugafanabebe.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://semowomeso.onlinewebshop.net/demulobinolapomit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cadc0598-81f2-426d-a9e2-8d41f693a670/nicomachean_ethics_2nd_edition.pdfIn PDF document text
    • http://mubodadekutaxim.atwebpages.com/47971726200.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/71154721-e7f5-4e52-8826-f1b5ad3e4aa7/32221351509.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bba5d53c-92ad-4ff7-91ca-20f502583550/verutefifimazemika.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32b02e16-03d5-4ab8-90ac-7dceab2b8792/how_to_connect_jabra_talk_55.pdfIn PDF document text
    • http://mawokale.myartsonline.com/difference_between_parliamentary_and_presidential_form_of_government.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ee270af-f0f7-490d-b273-b29cc8206e5c/vigizemuw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3c54be7-c3b5-40d7-a99c-3f3977b54d5f/where_can_i_take_calligraphy_classes_near_me.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc01a60b-3323-42e5-b744-d890a2a60028/love_simon_book_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c319240-695e-457d-95a5-9f23fdfcadd2/g1w_dash_cam_lock.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3da7cd6-5549-4488-8017-15e3aaf99c13/blackmagic_design_atem_television_studio_pro_hd_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8258e268-6e4a-4bc6-9bb0-c1db2a6aabf9/average_sat_math_section_score.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01dfdeb8-f3ef-47e4-b61e-dde6a505546f/hp_8600_printhead_amazon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8a2ef86-9e1a-4c5a-a012-d949f084a7fe/total_gym_direct_coupon_code.pdfIn PDF document text
    • http://xogijowag.onlinewebshop.net/xurigivepaxenusi.pdfIn PDF document text
    • http://vozerurivuboki.epizy.com/mumirazowifuruwifuw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001ee35.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EE35 5492 bytes
SHA-256: 679fadde2f43e9547e37818a8ab6baf62c796f10fdf495b2abdf49351f9de59c
font_01_sfnt_off000200f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x200F8 13380 bytes
SHA-256: bdea87dded2c6e76b1d196edc728dafb760d2a8489e928be2399a7d8ac912507
font_02_sfnt_off00022b4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22B4F 16224 bytes
SHA-256: e7820fc51e823c9510b69cd30def3c6041c113b552710f50053ecd1ea592d451

Open this report in the interactive analyzer, or submit your own file for analysis.