Malicious PDF — malware analysis report

Static analysis result for SHA-256 a123359f4f749362…

MALICIOUS

PDF

91.3 KB Created: 2021-03-20 22:08:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 32f540caa650da272d5eb6036364afe8 SHA-1: a2eb92341605a8596320127d55e9939573a63e7c SHA-256: a123359f4f749362cb49992355ad83191e012d67159663a54cba59e75cd41665
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded links, with at least one identified as a malicious redirector. The ClamAV detection and ML classifier further indicate malicious intent, classifying it as a phishing trojan. The embedded links likely serve to redirect users to phishing sites or download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=breves+cuentos+hispanos+pdf In PDF document text
    • http://ragofilud.medianewsonline.com/45612244567.pdfIn PDF document text
    • http://negedibomul.sportsontheweb.net/cervical_radiculopathy_treatment.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4473023/normal_601e66190e7c7.pdfIn PDF document text
    • https://cdn.sqhk.co/foturozav/dibThfe/uefa_champions_league_channel_canada.pdfIn PDF document text
    • https://cdn.sqhk.co/pofaxexaxi/h7tjjxc/42790934567.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452852/normal_603df0346f29e.pdfIn PDF document text
    • http://widaxaruko.mypressonline.com/speak_your_mind_2_free_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383930/normal_603c752a5a06d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385412/normal_5fc9391c35ba4.pdfIn PDF document text
    • https://cdn.sqhk.co/sodelaranu/Wjihbhh/reply_rsvp_confirmation_email_template.pdfIn PDF document text
    • https://cdn.sqhk.co/kidurukazag/fJxgige/47129623480.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467005/normal_5fd63b8d18c0c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://35b1a599-9f45-4897-82ce-59a931fc5495.filesusr.com/ugd/daca0d_da6d880683444790a24448fd74f37069.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/minabiwa/echo_show_2nd_generation_user_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/xukanomarexumu/27387268949.pdfIn PDF document text
    • https://2cfcb734-ec62-4cd9-b61c-03d4762ad765.filesusr.com/ugd/a891c0_5f1bcda761884c1194b61fb1b2b7c665.pdf?index=trueIn PDF document text
    • https://60659a61-a27b-47ea-8eac-a81775c62269.filesusr.com/ugd/7a7fb1_835582812bfb45b2986d9606badf4ef4.pdf?index=trueIn PDF document text
    • https://b304dada-1952-41b2-af44-d16a3232bb3f.filesusr.com/ugd/c19c34_645a9defa0ed463c8419700603121c0f.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012258.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12258 5320 bytes
SHA-256: 9c5091f3544b9a22d7870da124d8f517e8c331b8337983ab4e45b33a4e7924e0
font_01_sfnt_off0001347a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1347A 13228 bytes
SHA-256: 3aacc90ea349c58112137b204285e015010242db5e33bffbee4e9f75aa1518c8

Open this report in the interactive analyzer, or submit your own file for analysis.