Malicious PDF — malware analysis report

Static analysis result for SHA-256 adfb8d4fe186167c…

MALICIOUS

PDF

72.9 KB Created: 2021-06-11 09:07:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0303a1c810f73ac094a1f2f8795c291c SHA-1: 79f1efb5f95adb4c9047b5cfd404d4e5dcc3d4da SHA-256: adfb8d4fe186167c6d2b5a5b922d4c65341c8d05815b5027a1f6441b9fe290d0
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to 'synerhu.ru', which is likely a malicious domain used for phishing or distributing further malware. The document body, though partially corrupted, suggests a lure related to 'Pallikattu sabarimalaikku song lyrics'. The presence of multiple external links, some on disposable hosting, further supports a link farm or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/pbw?utm_term=pallikattu+sabarimalaikku+song+lyrics
    • https://vojerured.weebly.com/uploads/1/3/3/9/133999986/bugotopolefefarubegi.pdf
    • https://vunabiripiboxuw.weebly.com/uploads/1/3/4/7/134756527/1b64248dc3d89.pdf
    • https://subogepaweb.weebly.com/uploads/1/3/2/3/132302814/01b824623d23228.pdf
    • https://static.s123-cdn-static-d.com/uploads/4417988/normal_60b1e83407cdc.pdf
    • https://torudedo.weebly.com/uploads/1/3/4/3/134352944/f9be099e649a222.pdf
    • https://cdn-cms.f-static.net/uploads/4365659/normal_5fd2f74fc8d5c.pdf
    • https://ladipepisosixas.weebly.com/uploads/1/3/4/8/134898905/fimegab.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bilabegape.pbworks.com/w/file/fetch/144660786/writing_task_2_ielts_academic_questions.pdf
    • http://kemususi.pbworks.com/f/stray_cat_rescue_near_me.pdf
    • http://xibosini.pbworks.com/w/file/fetch/145101195/65950852643.pdf
    • http://gufabewa.pbworks.com/f/the_compact_bedford_introduction_to_literature_12th_edition_publisher.pdf
    • http://vafobotigef.pbworks.com/w/file/fetch/144636261/97912000761.pdf
    • https://uploads.strikinglycdn.com/files/eb7f3ba8-3aef-4d3d-b193-a3bada862d2f/nukutudesekanaxiwud.pdf
    • http://nosiravuga.pbworks.com/w/file/fetch/144471108/lactic_acid_bacteria_microbial_diversity.pdf
    • https://uploads.strikinglycdn.com/files/b71dcefa-3041-4bac-857a-03f4a3b37c67/it_service_operations_manager_job_description.pdf
    • https://uploads.strikinglycdn.com/files/470a0e5f-d988-4c25-9fb6-44ddf8d18f66/why_does_the_blue_light_keep_flashing_on_my_hp_printer.pdf
    • http://zobafolu.pbworks.com/f/muripala_mukunda_song_download_mp3.pdf
    • http://saladolu.pbworks.com/f/mortal_kombat_xl_ps4_fatality_list.pdf
    • https://uploads.strikinglycdn.com/files/53929637-8d9c-4ffb-9ca2-22273e1b08bd/whirlpool_duet_washing_machine_parts_list.pdf
    • https://uploads.strikinglycdn.com/files/8ea17c8d-ec84-45bb-9a57-9fde59ff4001/linksys_e3200_setup.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e056.bin
1e18db854a79d90dc0fb57f9daffc03382ed36bdaeae0dd6fe859d73695fd1a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE056 5428 bytes
font_01_sfnt_off0000f2c5.bin
42e4eb6575987dc68c98c76dc28b40360132751650a0e380b345b301f81714ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2C5 10540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.