Malicious PDF — malware analysis report

Static analysis result for SHA-256 a91017e0d2e21ab0…

MALICIOUS

PDF

84.5 KB Created: 2021-04-09 16:02:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 977a514d0c10cdcb018f2b9296f0a7b7 SHA-1: d3aa5fa01cf853727b45a0ba531b4d327f889bb3 SHA-256: a91017e0d2e21ab0f995f48f5b1937c7f2174d03dea9b11b92f5cd0f22e9a5d9
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by ML classifiers and ClamAV as malicious, specifically identified as a phishing trojan. Heuristics indicate it functions as a link farm, directing users to external URLs, one of which is associated with a recovery secret or private key request lure. This suggests the primary goal is to trick users into divulging sensitive account recovery information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=how+to+use+html5+tags PDF link annotation
    • http://jinoxiresajigeb.iblogger.org/crimson_tidestallion_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/sizozizaj/DPgfuSa/goosebumps_night_of_scares_gameplay.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414353/normal_5ffa717e27ef9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420608/normal_606a11a8bf6f5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366008/normal_60081cf812b27.pdfIn PDF document text
    • https://cdn.sqhk.co/borefigux/eB8OCjd/wavifijulasatunagivaf.pdfIn PDF document text
    • https://cdn.sqhk.co/mofekuma/hLghXgh/resident_evil_2007_movie_flix.pdfIn PDF document text
    • https://cdn.sqhk.co/gomurabog/eUfgfMC/24705724742.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384655/normal_603c12641ca04.pdfIn PDF document text
    • http://jalakerag.22web.org/25191841601.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457843/normal_604b522de320d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462694/normal_6037121fc7629.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://9db8f275-5044-409a-aa1b-3306d9dda9bd.filesusr.com/ugd/361f4b_b8338e82f34f4ed997d54635514f16c4.pdf?index=trueIn PDF document text
    • https://f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com/ugd/655f09_ab4e6cc4ea9f4467aac0dbbf32e1a049.pdf?index=trueIn PDF document text
    • https://eed7fa7e-4f31-4ba6-8269-e73f07ac74c5.filesusr.com/ugd/93374d_60ab4415376d42678873a9342a18f719.pdf?index=trueIn PDF document text
    • https://65d0a56f-4074-4e8f-9acc-29e6f8e8f663.filesusr.com/ugd/37655d_abc11d64da5e4da5afc626d7a9cc778b.pdf?index=trueIn PDF document text
    • http://farejuluwi.epizy.com/consul_template_haproxy.pdfIn PDF document text
    • https://d12e84a0-9808-45da-82c6-613dfe540d1b.filesusr.com/ugd/dc8a8e_66ca032b915547c7989292194ad6324b.pdf?index=trueIn PDF document text
    • http://ximagutetala.epizy.com/cardboard_sheets_london.pdfIn PDF document text
    • http://jotunozafe.epizy.com/17260786700.pdfIn PDF document text
    • http://xasitotimokines.rf.gd/samulinenaji.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D19 5180 bytes
SHA-256: f971419b81533c0d4a5141c8b781ccc4890ba53b478e5d701bce4b79ef668a26
font_01_sfnt_off00011ea8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EA8 11200 bytes
SHA-256: 9ce2dbe8712e397c75a9e1feee0a43b1895aa4132ee01d4160d543645fcd0243

Open this report in the interactive analyzer, or submit your own file for analysis.