Malicious PDF — malware analysis report

Static analysis result for SHA-256 a49ef6104e9725bb…

MALICIOUS

PDF

80.3 KB Created: 2021-03-22 21:21:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: f7e05704cfaa983e36f8278869404980 SHA-1: 38bec0046868a3a87ff33a9aeef010cbb8e2d726 SHA-256: a49ef6104e9725bb662a5539aca5856cc5e1634a330a11c233bbfe95ef80a4ea
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The ML classifier and ClamAV detection strongly indicate malicious intent. The PDF contains numerous embedded URLs pointing to disposable hosting, suggesting a phishing or malware distribution scheme. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, indicating the PDF is part of a link farm designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=active+learning+spaces+pdf PDF link annotation
    • http://fb-copyright-help-from.com/chess_board_size_for_3_inch_kingpz7bo.pdfIn PDF document text
    • https://cdn.sqhk.co/suwuwewazaka/gcighig/doganiledosoz.pdfIn PDF document text
    • https://cdn.sqhk.co/totafeta/idgdaPs/jifoxoliralosadolufevepa.pdfIn PDF document text
    • https://vajugape.weebly.com/uploads/1/3/4/7/134767319/33c2de450.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379848/normal_601734fe9a266.pdfIn PDF document text
    • http://blancer.xyz/perefiiwk64.pdfIn PDF document text
    • http://quickstore.pro/40440371107h4lzc.pdfIn PDF document text
    • https://cdn.sqhk.co/girewobo/kfhdHgd/giluveteroxijeg.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389353/normal_5fd0481d32b00.pdfIn PDF document text
    • http://nakijeku.mygamesonline.org/pagisefizisimojip.pdfIn PDF document text
    • https://fuwamelewupo.weebly.com/uploads/1/3/4/1/134131589/99332742419a.pdfIn PDF document text
    • https://dejalujufoleto.weebly.com/uploads/1/3/1/3/131378776/sekukafafekovo_datixoxamapofe_kexoxagiwo_vufoxaka.pdfIn PDF document text
    • http://swiss-gear.shop/xapesopuvorute80tl.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384045/normal_60065602ab40b.pdfIn PDF document text
    • https://jolovezenokomo.weebly.com/uploads/1/3/1/3/131398109/2303877.pdfIn PDF document text
    • http://usejus.club/problem_solving_strategies_freernkcx.pdfIn PDF document text
    • http://ewop.space/24475595566oewaf.pdfIn PDF document text
    • http://qwert-ita.fun/6063403037333nvr.pdfIn PDF document text
    • https://cdn.sqhk.co/tamurikubol/ew7p0hd/legend_of_king_arthur_camelot.pdfIn PDF document text
    • https://guxuxexor.weebly.com/uploads/1/3/0/7/130775085/21fa905b01b8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478123/normal_603d43a8d6fbe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465259/normal_5ff137d30cce9.pdfIn PDF document text
    • http://sallehub.xyz/40648161067qufwq.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://tixofimisupabev.onlinewebshop.net/bacteriophage_lytic_cycle.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0CC 5048 bytes
SHA-256: 189bf9a6db73c68aed65d19651e50a740c44f8d5118da75be0397f4fa7934d78
font_01_sfnt_off00010203.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10203 10228 bytes
SHA-256: 60616b3ac0129aa9ff182e55f59117095f4140cc6c7d851f497d2d43aedbcdbb
font_02_sfnt_off00012500.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12500 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.