Malicious PDF — malware analysis report

Static analysis result for SHA-256 a09bb3ed9184e010…

MALICIOUS

PDF

66.1 KB Created: 2021-09-27 05:50:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 46d2c55a2294e9ea6ee6362f268d9df3 SHA-1: c3819f0a73ce8646e1d717d88d9e1d37cea2dce5 SHA-256: a09bb3ed9184e010f8c3a23ce8500ccf62e331cd347ba7607e8f32c815211933
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ML classifiers and ClamAV, exhibiting characteristics of a phishing lure. It contains numerous embedded URLs pointing to potentially malicious or disposable domains, suggesting an attempt to redirect users to phishing or malware distribution sites. The document structure and heuristics indicate it's designed to appear as legitimate content, hiding clickable links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 7

  • PRC/3D content in PDF medium CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 66 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=gta+sa+apk+data
    • http://word.mn/uploads/assets/fomitixolefalasimewelar.pdf
    • https://alariel.be/userfiles/file/626487428.pdf
    • https://webkapper.nl/ckfinder/userfiles/files/pukotowomosuf.pdf
    • http://rc-mst.com/mst/_upload/files/23016125503.pdf
    • http://it-hair.com/userfiles/letasujevupireke.pdf
    • http://kindergartenhelden.at/upload/file/14309063172.pdf
    • https://z87992961.com/upload/files/20210922182949.pdf
    • http://bananamusic.tw/uploads/files/202109111918579651.pdf
    • https://muzeumkonstancina.pl/attachments/file/73957289192.pdf
    • http://turinhotelcompany.com/userfiles/files/87927218711.pdf
    • http://suncitygroup.ir/basefile/suncitygroupir/files/98086314844.pdf
    • https://tefen67.com/userfiles/files/12613850532.pdf
    • https://tungafilm.com/dorceiys/ckfinder/userfiles/files/30082152531.pdf
    • http://posicert.com/upload_fck/file/2021-9-16/20210916111602101896.pdf
    • https://rgcsmt.org/ckfinder/userfiles/files/92527713572.pdf
    • http://dinskayarealty.ru/media/file/64509732691.pdf
    • http://bowie.abwingsmd.com/uploads/files/koxegikunaxedititibe.pdf
    • http://jfe.hk/userfiles/barifumozigi.pdf
    • https://sainaudit.mn/File/52609522960.pdf
    • http://fjzy18.com/image/uload/files/guvanudoxokovinojoj.pdf
    • http://kasintorn.com/images/upload/files/pijodipimixisigolanapa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aab4.bin
06db487ef0d39d99acd0ca886aabe22d9b625849cfdbe4234c76e6d773e8b93f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAAB4 14120 bytes
font_01_sfnt_off0000cd9a.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD9A 16792 bytes
font_02_sfnt_off0000e5b0.bin
f9e5dd90ca61ab165855662af87cf1b5d81b27ac291eaa6626ca4b56b4d18556		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5B0 9920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.