Malicious PDF — malware analysis report

Static analysis result for SHA-256 92a87649f1f46ce2…

MALICIOUS

PDF

80.9 KB Created: 2021-03-12 15:40:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 302ebca5562bbc38e849c506f602ae6d SHA-1: 2a682565edbd35b97de3492828952b1b734e45c4 SHA-256: 92a87649f1f46ce293b7b2d4cebc6a71c9028e0f29d6f6a18d1395a6b43b99db
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links pointing to known malicious redirector infrastructure, specifically identified by the 'PDF_MALICIOUS_REDIRECTOR_LINK' heuristic. The document body, though heavily obfuscated, contains a URL that aligns with the malicious redirector. The presence of multiple links on disposable hosting further supports a malicious intent, likely to phish or deliver a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7909

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=does+table+salt+have+healing+properties In PDF document text
    • https://cdn-cms.f-static.net/uploads/4496216/normal_602ae87a97b33.pdfIn PDF document text
    • http://gekifek.scienceontheweb.net/what_is_cutover_testing.pdfIn PDF document text
    • http://tehnotop.site/xopumofoku6a4s1.pdfIn PDF document text
    • http://teplotronic.ru/80582128012rlor7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501794/normal_5ff918f2f2baf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379960/normal_603f41728006d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446497/normal_60052af14bb1c.pdfIn PDF document text
    • https://cdn.sqhk.co/jawezumate/lm5qZFH/altair_hypermesh_tutorials.pdfIn PDF document text
    • https://cdn.sqhk.co/jamosolil/AgiGvha/tomatosudiwifoduso.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://kisalonokexiwi.atwebpages.com/light_reflection_and_refraction_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b15a08bd-4214-4f0d-bb54-3b242b5f6340/kroger_blood_pressure_monitor_error_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8e6ad22-099b-4529-8aa2-09e084709cd9/govt_of_india_act_1935_divided_the_country_into.pdfIn PDF document text
    • https://s3.amazonaws.com/zuxime/36420945552.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/060c9870-3755-4236-9496-8d88e37550b4/what_is_the_role_of_statistics_in_research.pdfIn PDF document text
    • http://duvodix.myartsonline.com/the_purpose_of_writing_a_personal_narrative_is.pdfIn PDF document text
    • https://s3.amazonaws.com/ratixifo/832986709.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d355283f-9f5a-42ad-b899-1dca73ae50e3/calendario_sep_hidalgo_2019.pdfIn PDF document text
    • http://zilowovuv.atwebpages.com/69_camaro_service_manual.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC21 5068 bytes
SHA-256: c2393804270fec4f0eca4ca3cb56efc3024ae250c1eaac8e58e7bf3da593878d
font_01_sfnt_off00010d4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D4C 10848 bytes
SHA-256: 1af866db9427148a6f8a13a4c128537628ad76fcfdaef42ee8da01037c282fe7
font_02_sfnt_off00013260.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13260 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.