Malicious PDF — malware analysis report

Static analysis result for SHA-256 a75f2862bd4e0f29…

MALICIOUS

PDF

76.4 KB Created: 2021-05-11 04:01:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 71941afe0c7fc93f89bd5dc2bb76091e SHA-1: 2b71ae5118bd42c43949b039dfea258c7760f162 SHA-256: a75f2862bd4e0f2960e5cd866eaa45cda36b095f53f51e3387d00312ac84b5bb
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and is flagged by multiple heuristics, including ML and ClamAV, as malicious. The document body, though heavily obfuscated, suggests a lure related to appliance usage, directing users to a suspicious domain. This indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+start+bosch+800+series+dishwasher
    • https://static.s123-cdn-static.com/uploads/4470207/normal_5fdf12ff1d88e.pdf
    • https://static.s123-cdn-static.com/uploads/4374951/normal_600744225b014.pdf
    • https://static.s123-cdn-static.com/uploads/4452839/normal_5ff568909688e.pdf
    • https://cdn-cms.f-static.net/uploads/4369916/normal_603b915605491.pdf
    • http://copyright-rules-help.com/abi_yo_yo_songleec7.pdf
    • https://cdn-cms.f-static.net/uploads/4390663/normal_5fd7f82486268.pdf
    • https://cdn-cms.f-static.net/uploads/4384030/normal_60300e01c1c04.pdf
    • https://cdn-cms.f-static.net/uploads/4479674/normal_6039700b3c628.pdf
    • http://dirtygirl.fun/57996026858ercbm.pdf
    • http://gratoraama.space/rainbow_vacuum_repair_near_menh8fx.pdf
    • http://sefexetewizu.iblogger.org/princeton_university_colors_princeton_orange.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d99e5961-9bad-482c-83d5-a6a908032537/megiwofasikakosoxixof.pdf
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_a77d3d1b9bb44a50bd11f032d5902e3d.pdf?index=true
    • https://e02212b7-c8ec-4bf5-ba3e-d68a1de675e0.filesusr.com/ugd/7f1d73_f9c6511a2efd45128413e5d5059fa171.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a4453798-5daa-42ef-be46-2964f0e5e333/datimawafiledimik.pdf
    • https://uploads.strikinglycdn.com/files/1f7facfe-e56b-4d4d-ad7d-d4208006f271/71475235889.pdf
    • https://34ea5197-a9e9-4ba5-99bb-a7dd7aeba98b.filesusr.com/ugd/234f58_94f23a88b3c34af386a550d4a33fe60c.pdf?index=true
    • http://bopufadepop.epizy.com/inclined_plane_problems_and_answers.pdf
    • https://2ddf8be6-044d-4f30-b6fd-16c032829cd6.filesusr.com/ugd/9827ea_fe7a1dd202624fe9a676ee17d5eea1cb.pdf?index=true
    • http://fubuwutunofo.rf.gd/how_to_develop_childrens_communication_skills.pdf
    • https://uploads.strikinglycdn.com/files/f56adeaa-5c24-4a95-947a-3607694b66fa/nunorozowazidok.pdf
    • https://02274cc9-8b57-4441-be19-e46c089ec46b.filesusr.com/ugd/f11b8f_bae00b1714614238884839cf87a0606f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed89.bin
c5bb4a4f9429ecd135ea32f69c1e891b7d678da3fe2841c36ba4ed394b967797		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED89 5524 bytes
font_01_sfnt_off00010056.bin
eb5162728557cf28d091ea84a484608048227560500a51e61b2d811a2b972243		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10056 10428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.