Malicious PDF — malware analysis report

Static analysis result for SHA-256 a93d1bd1ba27aad5…

MALICIOUS

PDF

75.5 KB Created: 2021-06-03 23:05:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 3ebaae545b681eb66c0bca2e5b74dc5b SHA-1: 20aaf89dbb321f801e44243833d9763f448d85ed SHA-256: a93d1bd1ba27aad51ca6407d859e81d264130bf43c671e503acc5d35475ed4c1
226 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution T1534 Man-in-the-Browser

The PDF contains a link farm and is flagged by ML classifiers and ClamAV as malicious. The heuristic 'SE_MFA_LURE' indicates the document is designed to harvest credentials or abuse multi-factor authentication. The embedded URLs suggest a phishing attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/pbw?utm_term=where+else+can+i+use+a+bath+and+body+works+gift+card PDF link annotation
    • https://lizoxezubim.weebly.com/uploads/1/3/0/7/130776499/miwanulodo-figudixibipol.pdfIn PDF document text
    • https://komimarokobak.weebly.com/uploads/1/3/4/6/134604519/3b70dc8.pdfIn PDF document text
    • https://jaxefosizi.weebly.com/uploads/1/3/6/0/136083017/sagotilixurexaro.pdfIn PDF document text
    • https://bofuvozera.weebly.com/uploads/1/3/5/3/135331850/gifeso-vodafevive-kalerut-ropek.pdfIn PDF document text
    • https://vumetubav.weebly.com/uploads/1/3/0/7/130776444/fumix.pdfIn PDF document text
    • https://jaxedafotonomut.weebly.com/uploads/1/3/4/8/134885779/fimumudimom_pofaripol_xupavaza.pdfIn PDF document text
    • https://gususofutuzur.weebly.com/uploads/1/3/4/9/134901105/vomefig.pdfIn PDF document text
    • https://birakegisepes.weebly.com/uploads/1/3/4/5/134597855/fopudibunor.pdfIn PDF document text
    • https://lokuzovitopoz.weebly.com/uploads/1/3/4/8/134871506/voxaliwur.pdfIn PDF document text
    • https://zematewisa.weebly.com/uploads/1/3/4/8/134897668/boxedivufo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/001a9994-f351-4d71-b8ef-0b24bca6a856/velineon_vxl-3s_troubleshooting.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9dbd263-ac00-452a-b1d9-f464cdfc2e30/is_hunger_games_catching_fire_on_amazon_prime.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e970f25-ff92-4e7f-8421-8bfed368bc77/how_to_apply_for_pf_withdrawal_online_with_uan_number.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/763cb6fb-69fb-4fc9-8f11-ee0465bf71ce/83603979268.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/339e9e6b-db56-4e61-8a4f-d10adca498cf/how_to_pair_mini_jambox_with_iphone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/255ba095-a1e5-4290-b10c-3d01d7692ee5/love_and_respect_conference_youtube.pdfIn PDF document text
    • http://buvavipoluvu.pbworks.com/f/4319535826.pdfIn PDF document text
    • http://zopujoxobug.pbworks.com/f/sulatutuzabunadugodujivi.pdfIn PDF document text
    • http://vananizi.pbworks.com/f/65449981655.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76e324ec-c71f-4d03-80e3-fc59f54b7f3b/counter_strike_1.5_ekran_kk_nasl_bytlr.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7db75c3b-fd71-432c-bb44-bd78ac3c3c49/toyota_corolla_2009_for_sale_in_lahore_olx.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3c881aa-11fe-4376-90f1-73ad71a9fc35/labebut.pdfIn PDF document text
    • http://wuwazilizos.pbworks.com/w/file/fetch/144425397/presidents_choice_5_cup_coffee_maker_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52ec9f60-c520-45f5-bbfa-231c5f8fa4eb/wubosozusowevitubok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26d8fbc4-86f8-424b-9bb3-01fbca705989/how_long_do_timex_batteries_last.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef603a5c-0430-4f9e-b409-a1166067c731/luravowerisede.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4DB 5692 bytes
SHA-256: 13eff681309e214e9577daaa9203d6a5cdbe1ac194211ec3f7e33207143f2542
font_01_sfnt_off0000f858.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF858 11228 bytes
SHA-256: cca5cbbb3505546fb3e15640b403cde51df0f9e7f68209ab2f76f0f707bc7432

Open this report in the interactive analyzer, or submit your own file for analysis.