Malicious PDF — malware analysis report

Static analysis result for SHA-256 a34888bb6bf21cd0…

MALICIOUS

PDF

88.5 KB Created: 2021-03-31 21:11:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: d06826048c85aa04fb36038ecd6d9355 SHA-1: 8ea09373e867a01587df4c4f5fede471fc9ce700 SHA-256: a34888bb6bf21cd0db832dad6ac6a386aee68167d8d74570c2e42bb753a17f04
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, containing a link farm on disposable hosting. The embedded URL `https://midufefew.ru/award?keyword=boi+internet+banking+form+pdf` suggests a phishing attempt, likely to harvest banking credentials. No scripts were extracted, but the PDF structure and URL suggest a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=boi+internet+banking+form+pdf PDF link annotation
    • https://vupimolafi.weebly.com/uploads/1/3/1/3/131398504/744876.pdfIn PDF document text
    • http://indital.fun/50160913617simrh.pdfIn PDF document text
    • http://anbieterbewertung-autoscoutch.com/dell_latitude_e6430_i7-3720qm_specs4ol9v.pdfIn PDF document text
    • https://dusitibepilezu.weebly.com/uploads/1/3/1/4/131437978/wovuzazok.pdfIn PDF document text
    • http://paksorond.xyz/tipos_de_aplicaciones_informaticas0bdi3.pdfIn PDF document text
    • https://zudovizu.weebly.com/uploads/1/3/4/3/134338339/546b42c.pdfIn PDF document text
    • https://murasujudadalox.weebly.com/uploads/1/3/5/3/135338307/punewega.pdfIn PDF document text
    • https://siregudak.weebly.com/uploads/1/3/0/7/130738759/lasukoxufiri_mavojuxesage_gubepi.pdfIn PDF document text
    • http://souve.me/rules_for_using_quotation_marks_in_dialogueoioab.pdfIn PDF document text
    • http://stroymarketmetal.ru/how_to_clean_new_construction_hardwood_floorswew8v.pdfIn PDF document text
    • http://vevuxibuzezag.22web.org/environmental_auditing_definition.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://944456f3-75eb-4cd6-bbfd-656b3713ada1.filesusr.com/ugd/2c8d66_8866cb940c2a4ebf8e0aa67369985d7c.pdf?index=trueIn PDF document text
    • https://b1c30c75-ab46-439a-884d-3836ae4b8a49.filesusr.com/ugd/2d1648_5afbdce8bcdd4706964fb6dafd1f151e.pdf?index=trueIn PDF document text
    • https://fb1cd387-549b-40f1-a5a4-67fd65d29bb3.filesusr.com/ugd/4200b4_17a5eb274b5b4309823740a30bd3b781.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sazariwapa/calendar_app_for_android_mobile.pdfIn PDF document text
    • http://zukuvib.rf.gd/delavan_lake_wi_fishing_report.pdfIn PDF document text
    • https://s3.amazonaws.com/jinotugiwomo/non_aqueous_solution_chemistry.pdfIn PDF document text
    • https://s3.amazonaws.com/desenaz/mijufuvinuwadedovomigegif.pdfIn PDF document text
    • http://wadatenut.rf.gd/98259308214.pdfIn PDF document text
    • http://ximedamolaxeve.epizy.com/nonunonawejewamewajuzor.pdfIn PDF document text
    • http://rolefig.rf.gd/70097333541.pdfIn PDF document text
    • https://s3.amazonaws.com/pozokimepe/how_do_you_find_theoretical_framework_in_quantitative_research.pdfIn PDF document text
    • http://kixulal.rf.gd/34616678403.pdfIn PDF document text
    • https://3c4962d9-41f7-4f14-8396-dad57cc8de20.filesusr.com/ugd/a2de88_9be3b421df3a4f31a67e9ef706e7671f.pdf?index=trueIn PDF document text
    • http://jarexuvi.epizy.com/cake_recipe_and_procedure.pdfIn PDF document text
    • http://lozisuvuxinosog.epizy.com/android_tablet_screen_rotation_not_working.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000119a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119A5 5404 bytes
SHA-256: ef424f51791f2b76cfb978a876f9051d998f8c93038019a83db3af077f8407b7
font_01_sfnt_off00012bf7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12BF7 11912 bytes
SHA-256: 4f72bc967d89e05d72e13bbeade22db87fbe1f4b7b374d87c095365833a0f9b9

Open this report in the interactive analyzer, or submit your own file for analysis.