Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad99a4440b41aecc…

MALICIOUS

PDF

74.2 KB Created: 2021-03-09 05:37:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: 83b62fdeab6b258682c5e9da24c617f9 SHA-1: e1779d57bcd54b90cabdc8ca28e8fb6f236837b1 SHA-256: ad99a4440b41aeccc7b7e727f47d7d15ec43ec8c262c5538ff4149f8ccf33522
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous external URLs, many hosted on disposable domains, suggesting a link farm designed to redirect users to malicious content. The embedded content, though heavily obfuscated, likely serves as a lure to encourage interaction with these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=transfer+of+heat+class+7+questions+and+answers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4452152/normal_5fe8eaf25129c.pdfIn PDF document text
    • https://cdn.sqhk.co/milevatomog/9cjhQW1/zasud.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407807/normal_600c199e3ea1c.pdfIn PDF document text
    • http://wei-nmvc.com/why_is_my_tumble_dryer_drum_not_turningf23t5.pdfIn PDF document text
    • http://filanion.online/bsc_magazine_april_2019_download7u94r.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369499/normal_60104027d6d0a.pdfIn PDF document text
    • https://cdn.sqhk.co/woselukafo/fjeijgj/galaxy_attack_alien_shooter_pvp_tips.pdfIn PDF document text
    • https://cdn.sqhk.co/ruwonumatag/aZVhdia/63565895883.pdfIn PDF document text
    • http://tlgfree.xyz/gexelepuvikawqw824.pdfIn PDF document text
    • http://rezotu.xyz/brinkmann_smoker_cooking_timesc7lec.pdfIn PDF document text
    • http://tikovg.xyz/the_maze_runner_full_movie_480p_hindi_meinyx9mc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389568/normal_5feea2709639b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475203/normal_602df0fcaab8e.pdfIn PDF document text
    • http://kraftmann.su/wawizujirawarojinugajeliijb.pdfIn PDF document text
    • http://chelobaka.space/35697075913d1sfb.pdfIn PDF document text
    • https://cdn.sqhk.co/zifeduwa/igggejg/tabletop_simulator_d_d_5e.pdfIn PDF document text
    • https://cdn.sqhk.co/mugegiduveb/dyidR9z/57008148403.pdfIn PDF document text
    • http://pestore.pro/jagatatalaloxudegio18qs.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f730d15c-1921-46d2-b6d4-288333e40990.filesusr.com/ugd/e2c223_bbb4135e2869489ca9ed8ef895c7c9ff.pdf?index=trueIn PDF document text
    • https://eb40363d-1d1f-4170-a897-f23f0f433116.filesusr.com/ugd/2a1429_dbefab0503e84582bab2e0f1e0d75ca5.pdf?index=trueIn PDF document text
    • https://27aa3d6a-fcc1-4574-a8e0-77dd5bf64dcc.filesusr.com/ugd/7683ec_c1154c1b60324dc7833dbc11ff2d8d52.pdf?index=trueIn PDF document text
    • https://354df738-7a8c-4643-bdcd-aa58f7c4bd0c.filesusr.com/ugd/69cf62_40285a447f0443dba42c48f23f59aec1.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4D7 5356 bytes
SHA-256: 3c2db0826dee08a4fa89024950d4fe8897cc0b402a2d0ac96d38e7cc6995037b
font_01_sfnt_off0000f71c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF71C 10752 bytes
SHA-256: fa89ef8c527229964f4b80e40bf06d8a1bd6051c323502c42dfe9f7ada33510c

Open this report in the interactive analyzer, or submit your own file for analysis.