Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d8749477d2e327a…

MALICIOUS

PDF

80.1 KB Created: 2021-03-13 17:45:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: f27704304695b4cb028a2e4e1c8a5a3f SHA-1: bbd7bb9cf09f5938439cf898285c75f9e0e31318 SHA-256: 9d8749477d2e327a8b582b082f00f274e25172f0b9012ad97c8ed5038b6e714d
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was flagged by multiple high-confidence heuristics, including a ML classifier and ClamAV, indicating malicious intent. The presence of a PDF_SEO_UTM_REDIRECTOR_LINK heuristic suggests the document is designed as a lure for free downloads, leading to a phishing or malware distribution site. The primary IOC is the redirector URL, which is likely used to serve a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=cerfa+cession+vehicule+pdf+modifiable PDF link annotation
    • http://pixell.store/boeing_3_letter_airline_codeshk7in.pdfIn PDF document text
    • http://kobopez.mygamesonline.org/dewideginakavotap.pdfIn PDF document text
    • http://eslife.pro/pinimewuvevajejowvotq.pdfIn PDF document text
    • http://nabavawuzafurur.mygamesonline.org/48892410652.pdfIn PDF document text
    • http://scoretdho.best/lanisazebeweke8kqih.pdfIn PDF document text
    • http://tokepubex.getenjoyment.net/moleluwelodufegavawom.pdfIn PDF document text
    • http://zabolojisag.getenjoyment.net/lareke.pdfIn PDF document text
    • http://deladinabixek.sportsontheweb.net/nedudaj.pdfIn PDF document text
    • http://gojawufeki.getenjoyment.net/yamaha_portable_grand_dgx-505_user_manual.pdfIn PDF document text
    • http://borejukeluteva.mygamesonline.org/85544674444.pdfIn PDF document text
    • http://rollernefrit.xyz/8153373860227knw.pdfIn PDF document text
    • http://kogutojoveso.mywebcommunity.org/harry_potter_book_5_number_of_pages.pdfIn PDF document text
    • http://jekefidaz.mygamesonline.org/senibani.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mubemutolewe/densitron_lcd_display_datasheet.pdfIn PDF document text
    • https://s3.amazonaws.com/zafibimutadoti/demon_slayer_quick_guide_osrs.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzaganog/bcbstx_ppo_provider_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/latufenaw/are_john_deere_riding_lawn_mower_blades_reverse_thread.pdfIn PDF document text
    • https://s3.amazonaws.com/jazuravazaguz/sizukotagotejixora.pdfIn PDF document text
    • https://s3.amazonaws.com/vatakefojunib/wegefamuwarajuzosixake.pdfIn PDF document text
    • https://s3.amazonaws.com/gozilum/wewedelejolaxutilukoki.pdfIn PDF document text
    • https://s3.amazonaws.com/likerajatob/kaxivaguxipavasigidubux.pdfIn PDF document text
    • https://s3.amazonaws.com/muvevanepen/buying_motives.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7E9 5500 bytes
SHA-256: c5caa4f740c0421fc65d13b13ca771d59774aa9c4b31196284d2ad6c7e038f71
font_01_sfnt_off00010a72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A72 12148 bytes
SHA-256: 56ee6168f6309aa8a52f553a033962d85bfab9e0f6a1aaf29881b865566b4912

Open this report in the interactive analyzer, or submit your own file for analysis.