Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad3e001ac95c7269…

MALICIOUS

PDF

74.2 KB Created: 2021-03-09 20:41:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: dfd400de41a4c58b0dc13bf92bc22ef1 SHA-1: fe9795579e7657ff8e9b0fd8a844fecc3f15c4fd SHA-256: ad3e001ac95c72697330f1e45c017b9b1aa2ab4886442827a9bb477ef1f368d0
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a link farm and has been flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The embedded URL points to a domain that is not confirmed benign, suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and URL suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=fetal+warfarin+syndrome+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4425926/normal_603795d6c9800.pdfIn PDF document text
    • https://vejarava.weebly.com/uploads/1/3/1/0/131070596/sakiw.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451949/normal_5fe43a846742f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446633/normal_5fee3d982df96.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490515/normal_5ff015dcc2ffb.pdfIn PDF document text
    • https://tigidejuremu.weebly.com/uploads/1/3/4/5/134502839/9759383a480b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://c06d174a-caca-4ab2-b5a0-4525cd3135d4.filesusr.com/ugd/856cea_534ce8a695354a259eb1a9ef2f0432a6.pdf?index=trueIn PDF document text
    • https://4cd5a77a-be8d-44ba-8952-4177873115c4.filesusr.com/ugd/930050_d12b688a993046568162cf866ead7e2a.pdf?index=trueIn PDF document text
    • https://f3dbd103-cf2f-44fc-b0ad-c9004dc38af2.filesusr.com/ugd/1f2646_70d6ca521411498c902656ea70a5b936.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sorogamat/basic_reading_skills_worksheets.pdfIn PDF document text
    • https://c0b8f06b-4e98-4d3d-89ef-2f08caba629a.filesusr.com/ugd/0c8cc8_7572c8c6cbd94f1fb19651936643a967.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/veraxawewib/how_much_money_do_sewer_cleaners_make.pdfIn PDF document text
    • https://2cc12256-1025-444a-bacb-901a9f007bda.filesusr.com/ugd/d1fcfc_c51b4b48ac6c40579a1b3c1ca225abad.pdf?index=trueIn PDF document text
    • https://d992f69e-bc5b-430a-92d7-abfd66d0380b.filesusr.com/ugd/6f7357_d0735b092b9045849a6b648e249b1263.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ab4a695-b556-44cc-85d5-3b74597770be/bubixatamipiduz.pdfIn PDF document text
    • https://2a4b29e6-a790-453e-81e7-e8b9caf2c27b.filesusr.com/ugd/bf0735_9ffb0970250d443fb1cf9914f4e9b6ec.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d0b113e9-cb05-4581-89b2-ef8066465869/puwemoxodopoxejoj.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/xuvimebob.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4FD 5336 bytes
SHA-256: 037bbc00072bf813ef09ac6c7fbfc5d140d390971171d2ecb5036c91973ba9b0
font_01_sfnt_off0000f72c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF72C 10732 bytes
SHA-256: fea4676d4f6c21f33312cc4e40e310de75bb741eb88a3b87dcc5fdd2a0f2f2d8

Open this report in the interactive analyzer, or submit your own file for analysis.