Malicious PDF — malware analysis report

Static analysis result for SHA-256 93af828fd0d0257d…

MALICIOUS

PDF

97.4 KB Created: 2021-03-11 12:42:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02c04d244e0f919b4cb40b0616ec9be0 SHA-1: 17d361e76920f9729f31fe009e7948abf586d36d SHA-256: 93af828fd0d0257d808a0b08d1a57825fcb0cc941a49aa86837d33ac6c05a159
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded URLs and is flagged as a phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to a phishing site or download further malware. The document body, though heavily corrupted, contains keywords related to finance and investment, reinforcing the lure aspect.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=if+gross+investment+exceeds+depreciation+there+is
    • http://servempieza.site/lenakelavotogiwid4wfxz.pdf
    • http://alternativeinfluencenetwork.net/rirubozumolepatelugexq5eee.pdf
    • http://lassituda.online/1363510821929tpk.pdf
    • http://opensalle.xyz/tibetusakajumucpex7.pdf
    • http://white-x.fun/menesobuwedubexugidj7dcn.pdf
    • http://jijuduli.mywebcommunity.org/analysis_of_bank_financial_statements.pdf
    • https://cdn.sqhk.co/jivazufevi/QhhErij/2340727280.pdf
    • http://pearhaidhr.fun/53833399320lqk8i.pdf
    • http://astrology-personal.online/how_to_replace_ear_pads_on_jbl_headphones39o62.pdf
    • https://cdn.sqhk.co/sivunukiwe/bXieV2F/combat_assault_fpp_shooter_mod.pdf
    • https://cdn.sqhk.co/kigaratak/jjdiajj/reroromewesolev.pdf
    • http://cashfree.store/fajivikedafategizuo1ib.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5c420639-8f98-4c0f-9a5a-9928d51c1686/grohe_kitchen_faucet_quick_connector.pdf
    • https://s3.amazonaws.com/lebaxa/16758310123.pdf
    • https://s3.amazonaws.com/doxifuba/jemuf.pdf
    • http://zivexotafoni.myartsonline.com/sodafapofewab.pdf
    • https://uploads.strikinglycdn.com/files/fd01539f-541d-4a4b-84ea-a0729e59d9ed/fexopij.pdf
    • https://uploads.strikinglycdn.com/files/69fccd15-3142-4804-b105-e89e564094bd/how_to_do_a_frog_hop.pdf
    • https://s3.amazonaws.com/safenalavojuwu/mukoz.pdf
    • http://sitafefisoju.atwebpages.com/31870148539.pdf
    • https://s3.amazonaws.com/gapivegek/mamuzeruti.pdf
    • https://uploads.strikinglycdn.com/files/8185d204-1f34-4372-b76a-fc1f9beeebbb/gusutimetam.pdf
    • http://zitasixan.atwebpages.com/62863108557.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013f03.bin
eecd86551247c63db544705efc098e7a88f5ea0ab84a96ebfc2b567c9ad9407e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F03 5604 bytes
font_01_sfnt_off000151fd.bin
131ede8ef692f07cdb75e9c7b037dc45409dc28fbd7f395192c2370491fefaaf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x151FD 10984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.