Malicious PDF — malware analysis report

Static analysis result for SHA-256 92e24e4fec95271a…

MALICIOUS

PDF

69.1 KB Created: 2021-09-25 20:54:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: b6a69b5c213be0143125257864c1d1be SHA-1: 7b0f444592834ee3abb06bcecf61312241b958dc SHA-256: 92e24e4fec95271a449d468bebf110a7ebe65128b89dc12e9eeb5bf8bca593ef
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external URLs, with one specifically pointing to a potential downloader. The PDF structure also suggests it's part of a link farm, further supporting its role in directing users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/uplcv?utm_term=vdownloader+app+android PDF link annotation
    • http://premo.at/userfiles/file/zosafepino.pdfIn PDF document text
    • https://interativacorretora.com/fotosempresa/files/tedodid.pdfIn PDF document text
    • http://tfh-filter.hu/_user/file/guzivivovowuvako.pdfIn PDF document text
    • http://rilta.net/userfiles/files/94413057084.pdfIn PDF document text
    • http://nowator-zpu.pl/userfiles/file/kilutodexezuzo.pdfIn PDF document text
    • http://delfosventures.net/userfiles/files/kugibuvuzawujusunulixoma.pdfIn PDF document text
    • https://scalping.ir/data/files/file/kuwerigizekenepipojezelim.pdfIn PDF document text
    • http://leaguengn.com/userfiles/file///biduvefikarefeduki.pdfIn PDF document text
    • https://taperagi.com/contents/files/bujazonoxawibakegetitul.pdfIn PDF document text
    • https://bursakaynak.com/userfiles/file/noguwi.pdfIn PDF document text
    • https://hamasataccessories.com/userfiles/files/51032536259.pdfIn PDF document text
    • http://teleserviciomalaga.com/ckfinder/userfiles/files/gajunasasu.pdfIn PDF document text
    • http://xszhuhai.com/uploadfiles/files/zisuzujegimugarukuwefeja.pdfIn PDF document text
    • https://robustbrakes.com/administrator/imagetemp/file/50019445690.pdfIn PDF document text
    • http://milkyway-vn.com/upload/files/48100437361.pdfIn PDF document text
    • https://www.kiakaha.gr/wp-content/plugins/super-forms/uploads/php/files/cm3617vun9scd95koigmrtk4v7/xesamipelu.pdfIn PDF document text
    • http://dryoucosmeceutical.com/userfiles/files/tofidajabulegukopu.pdfIn PDF document text
    • http://er-trans.com/img/produkty/files/87483741270.pdfIn PDF document text
    • http://food-cloud.com/home/food-cloud/www/site/site/data/files/3793557352.pdfIn PDF document text
    • https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/711124706ba4a9d3c79c639d2753f8e9/7797666641.pdfIn PDF document text
    • https://ijp2.com/contents/files/86641237818.pdfIn PDF document text
    • https://www.peltonfell.org.uk/ckfinder/userfiles/files/sawonikof.pdfIn PDF document text
    • https://sherwoodchamber.org/ckfinder/userfiles/files/91305018770.pdfIn PDF document text
    • http://candemdientu.com/Images_upload/files/36826254503.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b1ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB1EA 10172 bytes
SHA-256: eb91ef6d4d70b77baa0fd9c919a5199e3f04249467e498fb9c7730ea008c403e
font_01_sfnt_off0000c8c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC8C0 15280 bytes
SHA-256: 87b1cb14f37e2446f3693ce46cc52d7c4e21e5a0f3621f5ed5be1c1990df4c2e
font_02_sfnt_off0000eeea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEEA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.