Malicious PDF — malware analysis report

Static analysis result for SHA-256 a888ec88f5eaf04c…

MALICIOUS

PDF

94.8 KB Created: 2021-03-24 10:46:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 8b68b6a3142c3654e67bd934c861ff83 SHA-1: 1e7dd4aeb1102ae8b342437e6748f0504dced7a4 SHA-256: a888ec88f5eaf04ca97964800f1c34541bd39a2c564f5798f2a12b50183088c4
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple embedded URLs, with a high concentration on disposable hosting and link farms, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect users to a malicious site for further exploitation. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=verb+tense+agreement+worksheet+pdf PDF link annotation
    • https://sopoxovolofu.weebly.com/uploads/1/3/4/5/134509961/65fead8564d4d2.pdfIn PDF document text
    • http://2020coupons.info/29773918298pvtzp.pdfIn PDF document text
    • https://kiluzamomumu.weebly.com/uploads/1/3/5/3/135344913/5523573.pdfIn PDF document text
    • https://gewewipuno.weebly.com/uploads/1/3/0/7/130775766/mejerobamab-fapumereka-vobuvonubumifi-vixudexivejinu.pdfIn PDF document text
    • https://cdn.sqhk.co/romilononove/yBie1yS/46561961565.pdfIn PDF document text
    • https://cdn.sqhk.co/busibelifiv/jbeiiC4/87518316165.pdfIn PDF document text
    • https://cdn.sqhk.co/wevexifimur/iiF9hgz/soledegizogalonar.pdfIn PDF document text
    • http://supermagazforsale1.xyz/61995007543erjvg.pdfIn PDF document text
    • https://ranixujofenak.weebly.com/uploads/1/3/4/0/134016935/nubotef.pdfIn PDF document text
    • http://bigops.fun/britax_car_seat_and_stroller_travel_systems1ti8.pdfIn PDF document text
    • http://wonizojaru.scienceontheweb.net/kinujojegegenuka.pdfIn PDF document text
    • https://cdn.sqhk.co/sobexofap/FrKD2gg/sesina.pdfIn PDF document text
    • http://ketaton.mywebcommunity.org/gelug.pdfIn PDF document text
    • http://reduslimitalia-official.site/3646182875i9l34.pdfIn PDF document text
    • http://manapuzasupin.sportsontheweb.net/ancova_in_spss.pdfIn PDF document text
    • https://cdn.sqhk.co/nemoludajedu/ejdevjb/recargar_celular_telcel.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://a22cca75-cc8f-459c-9eea-628147015b55.filesusr.com/ugd/2f8a36_c2f1928cc4294f77a5240658f1424c31.pdf?index=trueIn PDF document text
    • https://8f20b4bd-83f7-4a55-8c6f-e9501e2e061c.filesusr.com/ugd/c1c462_00080fb95c4542bab9b197addb4fb10e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe0bb89a-0385-43fd-b9a2-d11e0b24875b/arms_reach_mini_co_sleeper_sheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/922a332f-3f3b-47ad-ad07-bcd24e98d565/legopaxefazemez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c038453-03aa-4020-931f-39fb735c0f73/little_black_book_of_ukulele_songs.pdfIn PDF document text
    • http://ruvemad.myartsonline.com/48694066087.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/347f44c5-a592-4517-bd42-7a9f9f4ec1a7/13935832001.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C31 6744 bytes
SHA-256: 0eac1552a6a0cc8d6d43e14f5c157d052ff2bf21460314f67a2c213e0a454e63
font_01_sfnt_off00011d18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D18 5684 bytes
SHA-256: 96022f17c81e9896cd24c7c8d5ce0f5e0ac43ef01ce454bb2c3879e454a8d546
font_02_sfnt_off00013058.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13058 11788 bytes
SHA-256: 6bbe1a9ee6408be3eceb903dfd479170ac3dceb4ab4760d31dfc9b105eb73c02
font_03_sfnt_off00015853.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15853 16092 bytes
SHA-256: 9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2

Open this report in the interactive analyzer, or submit your own file for analysis.