Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d3769d6abcaeb14…

MALICIOUS

PDF

77.7 KB Created: 2021-09-20 11:34:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 73e5c8f204d0da8c35f926daa05fdf93 SHA-1: 41d03c8808d7900ea5b71bae5e358987a8b08510 SHA-256: 9d3769d6abcaeb14dff1a3acf93576d7b7cd02566a00eb675f6b184896938bf7
86 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by a machine learning classifier as malicious and contains numerous embedded URLs, many of which point to disposable hosting. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the document is designed as a link farm, likely to direct users to malicious sites or phishing pages. The 'SE_CALLBACK_LURE' heuristic suggests a potential callback phishing or tech-support scam pattern, although the document body itself is heavily obfuscated and does not provide clear textual content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9948

Heuristics 5

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/uplcv?utm_term=formula+of+ethanol+alcohol
    • http://grupopiscis.com/upload/files/56271268123.pdf
    • http://tatnhapkhau.com/ckfinder/userfiles/files/nodureluxupinurunejofuvep.pdf
    • http://aggengr.com/uploads/CMS/file/maritabad.pdf
    • http://kqcme.yiaiwang.com.cn/upload/files/21094455200.pdf
    • http://villabrown.it/userfiles/files/11302275448.pdf
    • https://reviewz.eu/app/webroot/files/userfiles/files/xapanufemurije.pdf
    • http://jr-bang.com/uploadfiles/20210902054507.pdf
    • https://jaukiaplinka.lt/ckfinder/userfiles/files/11307179654.pdf
    • https://wupaojichangjia.com/d/files/67839083873.pdf
    • http://begemot-rus.com/uploadfiles/file/2021090408010673499.pdf
    • http://guojingmall.com/userfiles/file///3543569580.pdf
    • http://dansensvenner.dk/imagesfile///90727161769.pdf
    • http://kantipursecurity.com/userfiles/file/vogimevup.pdf
    • http://www.synagoge-stommeln.de/ckfinder/userfiles/files/jotuxoro.pdf
    • https://vietrocknet.org/app/webroot/img/files/vesukolufif.pdf
    • https://eventpro-kontraktorpameran.com/uploaded/files/9433030036.pdf
    • http://skolky.info/foto/images/file/73391068648.pdf
    • https://www.ventisilva.com.br/ckfinder/userfiles/files/senerunasepumopalejusajul.pdf
    • http://travelcenterpuntos.com/campannas/file/giwezopanino.pdf
    • http://eduomania.com/wp-content/plugins/formcraft/file-upload/server/content/files/16139e9241de6c---tafata.pdf
    • http://donleroy.net/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/xasaligafuwukaxifuteloz.pdf
    • http://one9five.com/userfiles/files/vizafomiwupumijamosukesuf.pdf
    • https://hamzsabegi60szallo.hu/UserFiles/File/47530076625.pdf
    • http://aumnat2car.com/ckfinder/core/connector/php/upload/files/23548790628.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c61f.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC61F 16792 bytes
font_01_sfnt_off0000de31.bin
6470801b2f391fdd0afe4777491af48e43f8e7a924f108e3e9934d27612047a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE31 19688 bytes
font_02_sfnt_off000111f4.bin
d846ea5e12776de1dc1f03586a736ce30dec22dda53946fa6838d1b2705aedb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111F4 10416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.