Malicious PDF — malware analysis report

Static analysis result for SHA-256 97be7eeaf9bc5f80…

MALICIOUS

PDF

74.6 KB Created: 2021-03-27 18:46:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 1f687db4c9c416f9ac52789b9bd5c557 SHA-1: 0f944745031356133f935d0f5fe377c9defb854a SHA-256: 97be7eeaf9bc5f8088b656cfbea4bd40f4900ffcd7615b2ccce7bb23ff962c54
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. The document contains numerous embedded URLs, suggesting it functions as a link farm or phishing lure. The presence of external URIs and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic further support this, pointing towards an attempt to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=how+long+is+100+meters+on+a+football+field PDF link annotation
    • http://insurancesouk.com/what_is_a_pack_line_defense_good_forhw6cl.pdfIn PDF document text
    • https://cdn.sqhk.co/pafevola/hbigNjd/extreme_bike_driving_3d_mod_apk.pdfIn PDF document text
    • https://fofalada.weebly.com/uploads/1/3/5/9/135968840/pavofoge_bikanogi_divadogon.pdfIn PDF document text
    • http://idealica-it.website/duridazabadupesobujw0x.pdfIn PDF document text
    • https://fagozozefixus.weebly.com/uploads/1/3/4/8/134846406/8985169.pdfIn PDF document text
    • http://useplafond.xyz/a_feast_for_crows_chapter_294241w.pdfIn PDF document text
    • https://cdn.sqhk.co/lizubenesowi/ifijbgf/dibama.pdfIn PDF document text
    • https://cdn.sqhk.co/zikufojigox/hgX3WL1/84734866152.pdfIn PDF document text
    • http://tdsevsvet.ru/fire_red_release_date_jordanpeyzu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://a32e93c2-1aa3-4149-af29-aa5d163ab988.filesusr.com/ugd/40336e_92cd215898c9418ead7d90012bc45a18.pdf?index=trueIn PDF document text
    • https://7ce190f9-fb8d-496c-a51a-ce151dcc024a.filesusr.com/ugd/e72def_5d2e52d2f2084d1b8e01deab40f2d247.pdf?index=trueIn PDF document text
    • https://f55c6975-0091-4942-a106-dc80285e5f9d.filesusr.com/ugd/8a4248_a8a65bb812554dcf8cdcde4fe9999f1c.pdf?index=trueIn PDF document text
    • https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_7772f88e4a7e4653ae087cbc3877fd90.pdf?index=trueIn PDF document text
    • https://ba789de2-c385-43ee-b32d-a34c698d1993.filesusr.com/ugd/b7082a_8467bbb098ca42e184f6e001c021f6bd.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/ziwuvijevo/engineering_mechanics_or_mechanical_engineering.pdfIn PDF document text
    • https://dacf5b84-f80e-4bd8-bb7f-22aad20a1cd8.filesusr.com/ugd/285be4_821c84085d37449b9be8e78373f75e20.pdf?index=trueIn PDF document text
    • https://68a74d12-89ac-4a94-b826-09ad332a30bf.filesusr.com/ugd/1a0392_012e1c74415143888e9e0859e33b870c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fulazelof/how_much_is_ipad_mini_5_in_the_philippines.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6B3 5616 bytes
SHA-256: a7c011ba73cb69526e900d5aebe26e58d118e7a839ab3165b3cafbafd9986e77
font_01_sfnt_off0000f9cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9CB 10368 bytes
SHA-256: 71c1442665bbaf56c5b2971392377c015237d21078ada1b192d36339c8c6dc7c

Open this report in the interactive analyzer, or submit your own file for analysis.