Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f37825d8f0b0d52…

MALICIOUS

PDF

74.8 KB Created: 2021-03-25 12:29:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a2bc06926ce7ee9a3ebe342775c27ac3 SHA-1: e82dc4b06e9f02c7cad629cf19d529bb260d3342 SHA-256: 9f37825d8f0b0d527538a304107c7b1a5d2d9b0eece484fe6ca0bcb37eba2eb5
146 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one specifically identified as a malicious link farm. The document body, though heavily obfuscated, appears to be a lure related to a search query, aiming to redirect users to potentially harmful content. ClamAV detection and ML classification strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=how+long+does+a+craftsman+v20+battery+take+to+charge
    • http://kovamuwaropepu.getenjoyment.net/87309205197.pdf
    • http://mobeditobaxul.scienceontheweb.net/98960334583.pdf
    • https://vibomasovig.weebly.com/uploads/1/3/1/0/131070198/77a027489c0.pdf
    • https://wapatawavef.weebly.com/uploads/1/3/4/7/134775304/7536362.pdf
    • http://budokudepa.scienceontheweb.net/tetosafute.pdf
    • https://gozopurejogutix.weebly.com/uploads/1/3/4/5/134578339/fedejuta-fitonik-totimoliteza.pdf
    • https://buporinedo.weebly.com/uploads/1/3/4/0/134041533/legomarajozo-nodadiw-kutiga-pixiweke.pdf
    • https://famereruzune.weebly.com/uploads/1/3/1/6/131637342/7143974.pdf
    • http://patedeziw.mypressonline.com/canon_powershot_sx700_hs_software_download.pdf
    • http://jijegak.22web.org/26836490362.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/09646c6e-8864-4a1f-81d9-c816f6aef275/letosudorosimubu.pdf
    • http://xibatadamo.rf.gd/amazon_tajweed_quran_with_translation_and_transliteration.pdf
    • http://waxaravibew.epizy.com/google_presentation_themes_templates.pdf
    • https://uploads.strikinglycdn.com/files/06e9c1b4-f7dc-405e-a83e-247139efc22e/64299428773.pdf
    • https://s3.amazonaws.com/ziwuvijevo/mubobibuk.pdf
    • http://xivubijorudi.epizy.com/bronson_movie_dual_audio.pdf
    • https://uploads.strikinglycdn.com/files/d0911357-4e38-4d77-823e-a4ef51ed6251/lobiwogikavijevufuf.pdf
    • http://bufiziwo.rf.gd/36417637586.pdf
    • http://gapexod.rf.gd/serufajenimuxatumere.pdf
    • http://roraxekabitapoz.rf.gd/compulsion_2016_parents_guide.pdf
    • http://gukutimaguvuzum.onlinewebshop.net/cell_cycle_analysis_by_flow_cytometry.pdf
    • http://pobikifi.rf.gd/how_to_charge_a_nickel_metal_hydride_battery.pdf
    • https://uploads.strikinglycdn.com/files/b667c475-49ae-42e0-884c-e449ebca116c/how_to_develop_critical_thinking_skills_as_a_nurse.pdf
    • http://logabijizuz.epizy.com/actual_reading_test_2020.pdf
    • https://s3.amazonaws.com/navoburarovada/behind_her_eyes_sarah_pinborough.pdf
    • http://datidogebe.epizy.com/upper_back_physical_therapy_exercises.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e348.bin
69976d871ecd8df9aeab485af5489b995e699dc304961ea6c7f0e859ac298849		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE348 6128 bytes
font_01_sfnt_off0000f818.bin
42529caf04103ec0bf50e777d7efa91bfaf160a76c74e77dbc48bc1515cfcbe2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF818 10992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.