Malicious PDF — malware analysis report

Static analysis result for SHA-256 9641fb5c740d2bdd…

MALICIOUS

PDF

74.4 KB Created: 2021-04-02 23:36:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: ae94e464cac9422ba9cf3b4a79befe02 SHA-1: d3e0f50ca3eb5dfe6063a236da502bb80ab0f798 SHA-256: 9641fb5c740d2bdd72a5016385194278ed3f391d94f40be50689dac5a6ff2677
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded URLs, many of which are hosted on disposable domains or link farms, indicating a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to deliver a secondary payload or lead the user to a phishing site. While no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a common phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=how+to+install+a+zwave+light+switch PDF link annotation
    • https://basupetuwesaf.weebly.com/uploads/1/3/0/7/130739706/zupid.pdfIn PDF document text
    • https://cdn.sqhk.co/wafavalufa/4lhfwgh/suxipesidananaxisifil.pdfIn PDF document text
    • https://cdn.sqhk.co/joxipadij/gTzibnQ/pubg_stylish_name_generator_with_symbols.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456122/normal_60175057e8d2e.pdfIn PDF document text
    • http://sijibufaw.iblogger.org/vozisasi.pdfIn PDF document text
    • http://freshmind.net/660490374288uytm.pdfIn PDF document text
    • http://zoomita.space/20930494211j4e7t.pdfIn PDF document text
    • http://xevalarebufop.22web.org/ruwipiredaz.pdfIn PDF document text
    • https://cdn.sqhk.co/nunemiziku/ajg4gja/58771196439.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410190/normal_606665f73ebe6.pdfIn PDF document text
    • https://kesegupopu.weebly.com/uploads/1/3/4/1/134131766/lefejaveterite_pujilebopetatof_betoki.pdfIn PDF document text
    • https://xurarasetar.weebly.com/uploads/1/3/4/0/134096945/4119042.pdfIn PDF document text
    • http://constructionhouse.info/35541995987vcquv.pdfIn PDF document text
    • http://italy-small.space/193459017206u6ab.pdfIn PDF document text
    • https://cdn.sqhk.co/dibitarebizu/jvlu4ct/zombie_island_orlando.pdfIn PDF document text
    • http://usechambre.xyz/harry_potter_book_box_set_asdahr283.pdfIn PDF document text
    • http://picply.ru/how_to_pair_element_fire_tv_remotec8psa.pdfIn PDF document text
    • http://spiritstudio.ru/aghori_mantra_book6xupd.pdfIn PDF document text
    • https://cdn.sqhk.co/wadalibituge/Ydz5ghQ/rogopute.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tezitap.rf.gd/fifty_shades_of_darker_music_download.pdfIn PDF document text
    • http://kegaregajisojas.rf.gd/lipelurikuxumurajisawatov.pdfIn PDF document text
    • http://nekanonesogur.rf.gd/likorodepilu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4AA 5128 bytes
SHA-256: c5fb44da03cedb9c9db5372d7202f60bf46ae56cea2a380ff037e53786dc8f89
font_01_sfnt_off0000f63e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF63E 11024 bytes
SHA-256: 3e4572e57f11fb082f479dd274bdb60da6a6cc3709eec1222f736bb850afce7a

Open this report in the interactive analyzer, or submit your own file for analysis.