Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1d989855bb8d907…

MALICIOUS

PDF

82.3 KB Created: 2021-05-17 10:23:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 45c0e5dab392a48356a05f767cbbb77b SHA-1: 2e5dc397ff3846414dead6ed4d93a658b29b4875 SHA-256: a1d989855bb8d907d68eebaa7c1ef7bab3c2bdd847c66313263e9bde5c71ac07
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains numerous embedded URLs, many pointing to disposable or suspicious domains, suggesting a phishing or malware distribution scheme. The presence of external URIs and link farm characteristics further supports this attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=catholic+youth+minister+job+description
    • http://starconflict-game.ru/download_godzilla_2014_in_hindi_480pvdg9u.pdf
    • http://ig-soft-team.com/75898648239tlzje.pdf
    • http://badge-verification-center.com/51296735327erfku.pdf
    • https://wejitikokajed.weebly.com/uploads/1/3/4/6/134655746/sexelawitefolodifep.pdf
    • http://vitalia-transports.com/harry_potter_flute_music_sheetbuk1c.pdf
    • http://pressit.space/rafefogogazei74nd.pdf
    • http://art-practice.org/datadasupoboxojixorakesaejlzk.pdf
    • https://kenafowipadile.weebly.com/uploads/1/3/1/4/131437871/mupubalekadowen.pdf
    • http://inscarusa.info/jobotexumun9j93y.pdf
    • http://christinaanddavid2019.com/samsung_a105f_root_file9yjc5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://dilutevanu.epizy.com/bakodirenubifi.pdf
    • http://piwakolipa.rf.gd/nixon_the_unit_40.pdf
    • http://kozolamo.rf.gd/self_perception_theory.pdf
    • https://af8e4364-7f8a-45ec-af3e-d69da1c27fbb.filesusr.com/ugd/12c36c_91548d70877140aaa95a7418c3d4452e.pdf?index=true
    • https://a0d2adcf-75bd-42a9-a42a-c23e1c6e9e1a.filesusr.com/ugd/85c99c_96dc1c514b024e728e915cadb74db3ab.pdf?index=true
    • http://vesunisiwu.rf.gd/16521388992.pdf
    • http://welokisixipapa.epizy.com/australian_passport_application_form_child.pdf
    • https://add83a7c-0e31-48b3-928b-061d82ba9144.filesusr.com/ugd/205ae4_f2d63659afe2435587fc6bf49aa9f2ce.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e964.bin
900f6c725a42d6a60aaab79c7ca82fb24737cf7cc893a256d2b03219b880835f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE964 3588 bytes
font_01_sfnt_off0000f615.bin
bfdb5d6f15fa35daec6340d25e934337b8a2b6785a0f4bdc874fa157b2336185		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF615 5536 bytes
font_02_sfnt_off000108c1.bin
72cfd2ab193d4ac093556029468f05ba1ca8afe04dd92bf89eda4acc81c17378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108C1 10600 bytes
font_03_sfnt_off00012cdc.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CDC 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.