Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8814f6fa1d77def…

MALICIOUS

PDF

71.5 KB Created: 2021-03-25 21:24:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 384f524995c3d787a28c12c1219f419d SHA-1: 24d254c51c9810c9ecba4db868db5cb0a2cf9608 SHA-256: a8814f6fa1d77def4841d8f9a6d1009928fe64056453a39dcf4a1b870223af65
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to disposable domains, indicating a phishing or scam attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect users to a malicious site or download further malware. The presence of embedded URLs and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic confirm the lure mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=small+pdf+to+word+converter+download PDF link annotation
    • https://biwizodem.weebly.com/uploads/1/3/4/6/134650183/a02eb.pdfIn PDF document text
    • http://dfds.in/troy_bilt_tb110_carburetor_parts05smz.pdfIn PDF document text
    • https://gowajepev.weebly.com/uploads/1/3/4/9/134900038/getidinizudemi_sujej_pisixexodab.pdfIn PDF document text
    • https://zuxomizo.weebly.com/uploads/1/3/2/7/132710603/didapiravu.pdfIn PDF document text
    • http://chambrehq.xyz/price_of_generac_power_celliln0p.pdfIn PDF document text
    • http://riwotivadejud.sportsontheweb.net/definicion_de_derecho_procesal_civil_segun_carnelutti.pdfIn PDF document text
    • http://circulyarkadigital.xyz/pidovegapof519z.pdfIn PDF document text
    • http://wotedogupowu.sportsontheweb.net/pobaxugadinavibunugekix.pdfIn PDF document text
    • http://shopeuro.pro/18030962177xn6uc.pdfIn PDF document text
    • http://rabemedexisubis.mygamesonline.org/42715939990.pdfIn PDF document text
    • https://rupibofog.weebly.com/uploads/1/3/1/6/131607232/1092784.pdfIn PDF document text
    • http://toworugesolur.getenjoyment.net/radio_shack_weather_alert_police_scanner.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bokelur/lebozibena.pdfIn PDF document text
    • http://rofuvawitarul.atwebpages.com/fejojogazori.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b37d7b9-009b-47fc-b54f-79d12b7e2442/how_to_connect_hp_photosmart_plus_b209a-m_to_wireless_network.pdfIn PDF document text
    • https://s3.amazonaws.com/firigugixujotov/tifituvosobu.pdfIn PDF document text
    • https://s3.amazonaws.com/fekaduvopigab/3609363099.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a61c75e-ab58-4fef-8e41-473f3ca47e04/frigidaire_gallery_refrigerator_fghb2866pf_ice_maker_problems.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6532d4db-1ea8-4156-a6e9-b78bc3761467/streetcar_named_desire_book_cover.pdfIn PDF document text
    • https://s3.amazonaws.com/xeponodij/apowermirror_apk_for_android_4._0.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/263cf6cb-9d8b-4169-9ae5-2976d812ba41/jugogameteka.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b20b9a34-3322-466f-8d38-5216e69a794f/22044100704.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/84eebd25-d52c-4086-925d-16ffe48be95e/frasi_di_chiusura_mail_formale_inglese.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d93f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD93F 5380 bytes
SHA-256: 572df8dae9dd9e972fd314048834be82ea19c721bcbfd6f4f85709612e247f46
font_01_sfnt_off0000eb8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB8E 10944 bytes
SHA-256: 83f9b081170bdbaa06efda2ec22a6f212bb93ddafa16513124da63b96842b3e9

Open this report in the interactive analyzer, or submit your own file for analysis.