Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ff8339952042f06…

MALICIOUS

PDF

74.9 KB Created: 2021-04-24 10:56:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 468a1004dd0fc76d2b7af469c96a5ccf SHA-1: 7f6a197a3cd3fe80c76c4f3c2365be0ca958974f SHA-256: 9ff8339952042f060215b26611f846ebbaf0ee762ffc87c588a21d5f306d4913
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs that point to link farms and disposable domains, a common tactic for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to malicious content, likely as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.mothercare.ro/sites/default/files/webform/resumes/28941778760.pdf In PDF document text
    • http://pilgrimland.com/sites/default/files/webform/resume-uploads/tixatikuwasa.pdfIn PDF document text
    • http://portal-mysigma.com/system/files/student-proof/tevesifisota.pdfIn PDF document text
    • http://cicatsalud.com/html/sites/default/files/webform/25507329945.pdfIn PDF document text
    • https://www.visitsavannah.com/sites/default/files/webform/59391310887.pdfIn PDF document text
    • https://www.uts.cw/sites/default/files/webform/tidenopuzi.pdfIn PDF document text
    • https://www.uts.cw/sites/default/files/webform/tizodakemepegipupimegoxi.pdfIn PDF document text
    • http://www.guninetwork.org/system/files/webform/heirri_proposals/80098342864.pdfIn PDF document text
    • http://www.sumnercountyhospital.org/sites/default/files/webform/sixativitav.pdfIn PDF document text
    • https://www.natsihwa.org.au/sites/default/files/webform/bukitonixoravutewoluba.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=imax+b6+power+cordPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d050.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD050 5400 bytes
SHA-256: 96faa190956b274049c6426f675315fb7a00563992632778f7af48bfd36c1876
font_01_sfnt_off0000e2a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2A2 11156 bytes
SHA-256: 795cec4f2f17111fbd370c1eaa0ddab5683de543f4a675cc492f26429594c0c6
font_02_sfnt_off0001090e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1090E 16428 bytes
SHA-256: 038461760ce69cb47dc7ab5aeefc01eb687745765a086350e175e700f66c7602

Open this report in the interactive analyzer, or submit your own file for analysis.