Malicious PDF — malware analysis report

Static analysis result for SHA-256 b08a5aa220521985…

MALICIOUS

PDF

67.9 KB Created: 2021-03-14 19:53:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 49ffd829668b71aaf0b4b7f12b680abc SHA-1: c56dc23d7ebc7cb3c960f3a0b9578fc36797d75d SHA-256: b08a5aa220521985bd686f1b9a5de5dc8ed80dde8f3d277ecf703a207f4843c8
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs pointing to disposable hosting and link farms, suggesting a phishing or malware distribution scheme. The document body, though partially corrupted, contains keywords related to 'diabeticos pdf' and application information, likely serving as a lure to disguise the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9370

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=lista+de+intercambios+de+alimentos+para+diabeticos+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4474980/normal_604776c98ade4.pdfIn PDF document text
    • http://fomijegi.mypressonline.com/what_is_body_armor_lyte.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386613/normal_5ff8124ce47e5.pdfIn PDF document text
    • https://wezawelo.weebly.com/uploads/1/3/0/8/130813956/607011.pdfIn PDF document text
    • https://kotogafisix.weebly.com/uploads/1/3/0/7/130740127/d9abfb14f97.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421787/normal_602e2a3185080.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377679/normal_5febf7fe5a61e.pdfIn PDF document text
    • https://jufavufopu.weebly.com/uploads/1/3/4/3/134340263/rorogafogajip.pdfIn PDF document text
    • https://jokinurelebuvet.weebly.com/uploads/1/3/1/8/131856462/cbbc04aa36.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4378846/normal_5ff942ddf3a5a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418972/normal_60286ffca20a2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365652/normal_602d24dcc055f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471481/normal_5fc5bdc16a345.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://lexojowal.epizy.com/fabokaxix.pdfIn PDF document text
    • http://gakilasefit.myartsonline.com/18066847616.pdfIn PDF document text
    • http://rotufixijisadi.onlinewebshop.net/8332746709.pdfIn PDF document text
    • http://nirirojigupe.epizy.com/44497525479.pdfIn PDF document text
    • https://s3.amazonaws.com/boxujetanonikuv/be_like_bro_meme_templates.pdfIn PDF document text
    • https://s3.amazonaws.com/nazekisigiduz/very_nice_whatsapp_status.pdfIn PDF document text
    • https://s3.amazonaws.com/ravuxudibure/aambala_tamil_songs_starmusiq.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb3b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB3B 3564 bytes
SHA-256: a8fd1e15d3130d14081cb033f7424123ee08e5003d70bf59318a72fe5916729e
font_01_sfnt_off0000f7f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F3 5384 bytes
SHA-256: 17b70cbc9bf308f9b9f120e7422abe400dd4e6c68276eb3d2c3af9bec1360f4d

Open this report in the interactive analyzer, or submit your own file for analysis.