Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a8e79d9d6ffd90e…

MALICIOUS

PDF

80.4 KB Created: 2021-04-13 19:16:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: fa6bd6a84b396ad340bed9cf56a34a65 SHA-1: 22d2882df1184ba8e1752b8a8e68be23a11d1ad2 SHA-256: 9a8e79d9d6ffd90ed9556daf84d1c230de55b51d4882690facf2b376797675ed
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'crophysi.ru'. This URL is likely used to phish for user credentials or deliver further malware. The ML classifier also strongly indicated maliciousness, and ClamAV detected it as 'Pdf.Phishing.Trojan'. The embedded link, despite appearing to be related to job search terms, redirects to a suspicious domain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=ethical+hacker+salary+in+canada+per+month In PDF document text
    • https://cdn.sqhk.co/xugiwatokax/pPJf4nO/lebezilawav.pdfIn PDF document text
    • https://cdn.sqhk.co/kegetaxob/3xjgj68/fireboy_and_watergirl_3.pdfIn PDF document text
    • https://cdn.sqhk.co/nujamuxeg/sYsgghg/hovercraft_takedown_cheats.pdfIn PDF document text
    • https://wepujemu.weebly.com/uploads/1/3/1/4/131453456/minixizutapofozo.pdfIn PDF document text
    • http://wunadimizurened.medianewsonline.com/kevewisuwigopenito.pdfIn PDF document text
    • http://panedapupugaxe.22web.org/kirig.pdfIn PDF document text
    • http://ririzobe.medianewsonline.com/dizidu.pdfIn PDF document text
    • https://mumilupoj.weebly.com/uploads/1/3/5/3/135351188/fivusemave_ximimumarojuz_gujajituxozada_farodatixi.pdfIn PDF document text
    • http://xukosususif.medianewsonline.com/2901841311.pdfIn PDF document text
    • https://jasebezaf.weebly.com/uploads/1/3/4/6/134630561/tadiru-wikam.pdfIn PDF document text
    • http://tewajaz.iblogger.org/athens_airport_map.pdfIn PDF document text
    • http://wititabeg.22web.org/star_trek_the_next_generation_season_3_episode_23.pdfIn PDF document text
    • https://cdn.sqhk.co/minutakumu/IwHRidM/sufowejasonapo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://9db8f275-5044-409a-aa1b-3306d9dda9bd.filesusr.com/ugd/361f4b_0c3aa103c0094ca896f4a2d58b95cc16.pdf?index=trueIn PDF document text
    • http://jisidanosesozu.epizy.com/niruxufapubun.pdfIn PDF document text
    • http://pikubub.onlinewebshop.net/tutorial_corel_draw_x5_lengkap.pdfIn PDF document text
    • http://logumowomupexi.rf.gd/church_of_nigeria_anglican_communion_constitution.pdfIn PDF document text
    • http://zedofaxuboz.onlinewebshop.net/computer_awareness_book_by_arihant.pdfIn PDF document text
    • https://79d86aa2-23c4-4aa0-a0dc-c16ac59ae55d.filesusr.com/ugd/ecb701_aabeef0e62954493a784261e21aed392.pdf?index=trueIn PDF document text
    • http://dadeporofi.epizy.com/how_to_fix_diaper_genie_complete_spring.pdfIn PDF document text
    • http://mapodivopabo.rf.gd/nibixegasujizivupidi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb66.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB66 5436 bytes
SHA-256: 41ce3dd1726500a9ef2aa7f90f53c7755811af48b77d4888f9e32a40bd85beee
font_01_sfnt_off00010dc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DC6 11420 bytes
SHA-256: 493e36d3ac290268727cac18c38c1127bc82f5a7a47742e4feac3fe164f7b9b5

Open this report in the interactive analyzer, or submit your own file for analysis.