Malicious PDF — malware analysis report

Static analysis result for SHA-256 b121c5fddf245a0c…

MALICIOUS

PDF

67.8 KB Created: 2021-03-21 23:36:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d8ce47e6f20e3604f7ecfa71d96b8736 SHA-1: 82420761b680477bec621490a82a5c8c6a402294 SHA-256: b121c5fddf245a0c9065eddfdd8f8d1a04250a13a4e0d1efb452a502e2a9fb8a
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many of which point to disposable domains and are flagged as part of a link farm. One prominent URL, 'https://dafemum.ru/strik?utm_term=comcast+x1+remote+manual', suggests a phishing lure related to Comcast equipment. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for credential harvesting or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=comcast+x1+remote+manual
    • http://ligugiban.scienceontheweb.net/menasisagozamiramut.pdf
    • http://zajiledafalam.getenjoyment.net/likunadejexanuzi.pdf
    • http://xuzerujagojagip.scienceontheweb.net/84962788754.pdf
    • http://mimivudarevi.scienceontheweb.net/jifojexu.pdf
    • https://cdn.sqhk.co/menekilebuz/Biigjhj/livifuluxerenewevopuri.pdf
    • https://cdn.sqhk.co/kiviziko/jdbLhaQ/chalice_dungeon_platinum_guide.pdf
    • https://cdn.sqhk.co/nizivatitogu/ggzACuz/viera_name_generator_ffxiv.pdf
    • https://cdn.sqhk.co/vipujitebiki/jjib9ii/getudox.pdf
    • https://cdn.sqhk.co/pipagalax/bgdQJzM/gipumamojule.pdf
    • http://zetumitufam.mywebcommunity.org/anemia_hemolitica_2020.pdf
    • https://gipavenox.weebly.com/uploads/1/3/5/9/135966662/wonikonetobimat.pdf
    • https://warazafipa.weebly.com/uploads/1/3/1/3/131381481/0e6e64a3183e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://64e1471b-64f8-4582-b127-b1692805dd1b.filesusr.com/ugd/507a3d_8fd43f65ad874af28ca2479aadabc906.pdf?index=true
    • http://lazuletezofik.onlinewebshop.net/guitar_chords_chart_download.pdf
    • https://a540aa65-2eb1-4ac3-86d0-bf6a54daac96.filesusr.com/ugd/2d797c_b122471272164600923a47d6ce0d2853.pdf?index=true
    • https://s3.amazonaws.com/fulosobezur/57874405846.pdf
    • http://diwavubodinaroj.myartsonline.com/how_do_you_fix_a_burner_on_a_gas_stove_that_wont_light.pdf
    • https://ed7c5604-ec0f-4ae6-9d22-6d534b57d154.filesusr.com/ugd/1d5a3f_7946bc8bbf9b497c946e121e77f5aa2c.pdf?index=true
    • https://s3.amazonaws.com/xozeb/polycom_hdx_4500_datasheet.pdf
    • https://f6e2a16f-d004-42cd-8f17-0463e090774c.filesusr.com/ugd/c70c35_53c17ea0c2964557a5bfc90d9919b9d5.pdf?index=true
    • https://1de4b56a-3309-4767-83a2-f1bb1ea7c594.filesusr.com/ugd/a6e5e9_e187be8df76e4a56900631d02fb19c67.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cef8.bin
9bf68a10772889126bce2e6640a2fc9f413867f6d1958e608581e8c07e124fad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCEF8 4968 bytes
font_01_sfnt_off0000dfca.bin
88314a282b0cdbc6080fe11e7aa550b26093f353028de676a92b8ec8bc721f33		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFCA 10052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.