Malicious PDF — malware analysis report

Static analysis result for SHA-256 a06806fb7b33148f…

MALICIOUS

PDF

80.5 KB Created: 2021-05-03 12:14:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 7be59950ff4d3f63e01f0f2e7a915dab SHA-1: db1b21b533a8978ce6a0338eb57a499094521c6d SHA-256: a06806fb7b33148fe4fa1d94804894c5c102e821fe5d2cb91801e224845792be
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one specifically identified as a potential phishing or malware distribution point. ClamAV detection and ML classification strongly indicate malicious intent. The document body, though heavily obfuscated, appears to relate to mathematical content, suggesting a lure to disguise the malicious nature of the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=integration+of+cosecx.cotx+with+respect+to+x+is PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4452837/normal_6027792a60c40.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451545/normal_6004d8fe7c254.pdfIn PDF document text
    • http://belkwigs.com/interior_angles_of_polygon_worksheetc3rfd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374021/normal_602e6148a937b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372972/normal_605f7f63602d3.pdfIn PDF document text
    • http://pubguckazan.com/download_game_carx_drift_racing_mod_apk_data7tf85.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448991/normal_5feb4194992fe.pdfIn PDF document text
    • http://casser.xyz/nebilusufhegul.pdfIn PDF document text
    • http://copyrightsupport-ig.com/how_to_define_my_religionaj44u.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_1635eae6def64588847feb98339733f0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kavugusepe/26792596680.pdfIn PDF document text
    • https://27420876-d215-4860-9a72-f48db0d0c320.filesusr.com/ugd/4062c2_e649532a96264c1db1e6e4faacb320a8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/saxefi/jasexumizi.pdfIn PDF document text
    • http://zoxirebetezeguz.epizy.com/canon_ipf785_service_manual.pdfIn PDF document text
    • http://jiporiri.rf.gd/64623994171.pdfIn PDF document text
    • https://34570882-574e-4d25-8c0e-d8b9b6c2967f.filesusr.com/ugd/cb2bed_db7d21112b994fa3b38397ce9139769c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fusidejebi/50889438384.pdfIn PDF document text
    • https://1a447ccf-a6a5-490c-ad31-399ae8169532.filesusr.com/ugd/cf5184_e11ec4e4d5a1474cb0fd331d211747a9.pdf?index=trueIn PDF document text
    • https://45f61934-b4a1-4335-a9e3-e142d9465b5b.filesusr.com/ugd/0dd040_8b6b4ea5c88e486d96f254f6b9088299.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/marimejerebo/malayalam_amar_chitra_katha_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e247.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE247 5372 bytes
SHA-256: 497c97f8da7b9ff88b15929e5d3e943ab6513cd4ae990ae7721b34b14cb77e5c
font_01_sfnt_off0000f4b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4B3 12284 bytes
SHA-256: 798e8a5fa21c3c93cc2a1a35af334a18c9dfb83ea835ffd68991e684d08c0b27
font_02_sfnt_off00011ec5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EC5 16184 bytes
SHA-256: 89c208c5973a3c695bba959c66362a10f0c6c59a87e6967c78d3dea7ec8928c2

Open this report in the interactive analyzer, or submit your own file for analysis.