Malicious PDF — malware analysis report

Static analysis result for SHA-256 98e3496c9afa2350…

MALICIOUS

PDF

84.4 KB Created: 2021-02-21 21:00:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 1ded857d820e3824f3254fdb143c454a SHA-1: b01af424a5df25f95a2895c8662e212c6dc02712 SHA-256: 98e3496c9afa23507e4ff199260d3cf766638544273e0c874b0d851ccbd56fc5
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The PDF contains numerous embedded URLs pointing to various domains, indicating a link farm designed to redirect users to potentially harmful sites. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggests this is a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=the+great+indian+diet+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4446382/normal_60298900441bb.pdfIn PDF document text
    • http://national-verifyteam.com/yahoo_mail_attachment_androidqppku.pdfIn PDF document text
    • https://lupagizan.weebly.com/uploads/1/3/1/6/131637074/jopimewewu_pofonogebuzi.pdfIn PDF document text
    • https://nifogagerosore.weebly.com/uploads/1/3/5/3/135300162/1504702.pdfIn PDF document text
    • http://brumbum3.xyz/complaints_procedure_template_nhsimcpt.pdfIn PDF document text
    • http://scoretdho.best/joviguzetezatibizubagajhfnw6.pdfIn PDF document text
    • http://naturfresh.fun/adding_and_subtracting_algebraic_expressions_worksheetshzibh.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455374/normal_5fe6bce82cb97.pdfIn PDF document text
    • https://jukuxalubena.weebly.com/uploads/1/3/1/4/131453985/koxapibipunulesodopi.pdfIn PDF document text
    • http://ridunculus.com/kugigupuxezu00jgd.pdfIn PDF document text
    • https://gizutiki.weebly.com/uploads/1/3/4/4/134478998/c5c9618ca5021.pdfIn PDF document text
    • http://bu-markett.com/679924038495k2zp.pdfIn PDF document text
    • http://proita.fun/fishbone_methodology_template4esz4.pdfIn PDF document text
    • http://bigops.fun/sears_underwear_catalog_1979pkp7w.pdfIn PDF document text
    • http://beamorem.com/tristram_shandy_critical_analysistqoig.pdfIn PDF document text
    • http://romeital.space/konelasumikajeririjanodo07zjb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F67 5040 bytes
SHA-256: a5afd3464437936f1349060c5bb9be58128d75bf52719133ba1d268496e8adf0
font_01_sfnt_off0001208b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1208B 10524 bytes
SHA-256: 741c4f88633f132a9802fa252175dabf84ffec923789d6405512facdab3db881

Open this report in the interactive analyzer, or submit your own file for analysis.