Malicious PDF — malware analysis report

Static analysis result for SHA-256 a48d7c01a80cda15…

MALICIOUS

PDF

82.1 KB Created: 2021-03-07 12:24:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: e319c6fa3f270c0b705e6b86901b0070 SHA-1: bedfe2930317e128081f6485e8e60f58f2bbee1b SHA-256: a48d7c01a80cda152eddb9b76f999e3c4bf33e23bb2eb980286b323855050124
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs pointing to potentially malicious domains, identified by heuristics like PDF_SEO_DISPOSABLE_LINK_FARM and ML_NYX_PDF_MALICIOUS. The document body, though partially corrupted, suggests a lure related to a Bible passage summary, which is a common tactic for phishing or distributing malware. The presence of external URIs and the high ML score strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/wix?keyword=luke+1-6+summary PDF link annotation
    • http://lastmarkt.ru/lapazutiriwixa1w1jp.pdfIn PDF document text
    • http://storeplus.info/pemoxevinuvuwefojeqlp49.pdfIn PDF document text
    • http://libralab.digital/27587508561cn0u2.pdfIn PDF document text
    • http://wiinorama.website/republic_of_china_simulator_2412s3.pdfIn PDF document text
    • http://cybety.xyz/bekiguse1wk.pdfIn PDF document text
    • http://simcars.ru/how_to_add_disney_plus_on_apple_tv_3rd_generationgspq1.pdfIn PDF document text
    • http://50offstore.info/jevefimomanxq2ht.pdfIn PDF document text
    • http://digitalliteracyinstitute.com/92840935268m8kp4.pdfIn PDF document text
    • http://jaxebememapi.iblogger.org/tesefogabuj.pdfIn PDF document text
    • http://rimka.xyz/54727717335plszg.pdfIn PDF document text
    • http://banquepopulaire-fr.org/8675788393g4syq.pdfIn PDF document text
    • http://pay-order.info/panasonic_kx-tgp500_reset_passworda95ea.pdfIn PDF document text
    • http://swiss-gear.shop/mitsubishi_plc_programming_booksone8u.pdfIn PDF document text
    • http://callup.today/338527247286ki8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tukutuxobolekub.epizy.com/kafimanevenokosiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/122ac5c9-0dd0-4ca1-88bd-670c55738325/18772287286.pdfIn PDF document text
    • http://valunat.rf.gd/redegidixefidevatozatap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b2093db-eb3d-4155-8cba-7e76a00eb89d/serious_daring_ebook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/597fffa4-1fa3-41dc-851a-c53ffdc1ac07/which_black_and_decker_workmate_do_i_have.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/965f27c0-3cc1-49e7-964f-923786f74626/53990781797.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/752dccf9-1d50-4431-b020-0a7c0f779d8a/52219348753.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ffe2b55-2e70-4a34-be04-a2563d622b67/the_narrative_of_the_life_of_frederick_douglass_an_american_slave.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5aac6296-3cb3-41b6-99bd-dc12de9fe8f8/what_does_hopper_with_sling_do_on_dish.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/792d0cb7-ebca-4718-af26-d87faed398ca/mixafavaziruzug.pdfIn PDF document text
    • http://dolasuwukino.epizy.com/doxelebajiteralisa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105EA 5144 bytes
SHA-256: f61d5dd451c7d5c3a12a3b7728be7f42630f9878758e195487e8f37ddda2074e
font_01_sfnt_off0001176b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1176B 9988 bytes
SHA-256: 1478df9110ab19f182d027b412fc33f27a55d387851b8054351b9959299abc9e

Open this report in the interactive analyzer, or submit your own file for analysis.