Malicious PDF — malware analysis report

Static analysis result for SHA-256 9679f270d73ae5b9…

MALICIOUS

PDF

77.3 KB Created: 2021-03-19 14:37:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 64f56e288bec56faaa688846bcee8a9e SHA-1: 59c04734d38368774d9d26dcb4cb45919cd52526 SHA-256: 9679f270d73ae5b9aacaaf09123a9f222b465b73d4f3aa778726676cdc34199d
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with at least one pointing to a link farm on disposable hosting, indicating a likely attempt to redirect users to malicious sites. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it might be a generated document used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=kenny+veach+body+found
    • http://lozhobelir.space/404971212738g4oj.pdf
    • https://cdn.sqhk.co/tipefima/fpgdOy4/stick_ninja_2_apk.pdf
    • http://vipmanmarket.space/when_rabbit_howls_audiobookey79w.pdf
    • http://xepidenad.scienceontheweb.net/lotos_lt5000d_plasma_cutter_review.pdf
    • https://cdn.sqhk.co/vekuperik/ifvgf7O/vinuxijel.pdf
    • http://reggis.info/porque_hoy_es_feriadoa5ggi.pdf
    • https://cdn.sqhk.co/togokitaz/hghXihy/monster_car_hill_racer_2_hack_apk.pdf
    • https://cdn.sqhk.co/rapawaferew/YOihJMR/zaremuk.pdf
    • http://tonojodozif.mypressonline.com/senior_software_architect_salary_boston.pdf
    • http://reactivaperu-2020.com/xivobimiwupilcr4.pdf
    • http://selectgetc.top/6258907279am2rv.pdf
    • http://segwaywheelchair.ru/functional_independence_measure_fim_espaolajra6.pdf
    • http://mikrotikwizard.com/most_beautiful_wallpapers_for_mobile_phones943my.pdf
    • http://creamwalls.online/behavioural_interview_questions_and_answers_for_executive_assistantsn13r4.pdf
    • http://alisabor.design/44944519160ia8la.pdf
    • http://jekenufakewe.mypressonline.com/irulu_x7_specifications.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://tonorepunad.myartsonline.com/anatomy_of_human_body_drawing.pdf
    • https://uploads.strikinglycdn.com/files/eb911676-1053-4c8f-92fb-3942f6e32cf8/43147884188.pdf
    • https://uploads.strikinglycdn.com/files/f98ee6c9-86a5-4331-a6df-4d72aaadf2db/70746602653.pdf
    • http://kowifojabar.rf.gd/burger_king_coupons_canada_july_2019.pdf
    • https://uploads.strikinglycdn.com/files/cb422cc4-fe78-4441-a53f-9045648fb45d/zujixajifaluri.pdf
    • http://duwagisu.epizy.com/brandsmart_near_me_us1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e37c.bin
1a50761d0418ceee20240fb6c215a602c53d34596cfa30e90490b23a5c31c6d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE37C 4828 bytes
font_01_sfnt_off0000f3e3.bin
e379368b40a36f4834f44b45c8016b4d7a52ba2fb09f06403949c42debbb9eb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3E3 10724 bytes
font_02_sfnt_off0001184a.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1184A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.