Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3aa1cc0782de05a…

MALICIOUS

PDF

83.7 KB Created: 2021-04-26 00:01:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5237b951a714ecb9947bf02b683fa986 SHA-1: 7dd1eab14aa8f418eb73b4e0be181bd073efc6fb SHA-256: b3aa1cc0782de05a2c3c760eba58e140f3ff31940a8af39be4a52e45e309c99d
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier indicating maliciousness. It contains numerous embedded URLs, many of which point to disposable hosting and appear to be part of a link farm designed to redirect users. The presence of external URIs and the overall structure suggest a phishing or malware distribution attempt, likely initiated via spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=whole+milk+on+21+day+fix
    • http://presentinsta.online/hitachi_miter_saw_c12rsh_parts4j8t5.pdf
    • http://pojapusevipuzu.mypressonline.com/xibusomikikizijezigon.pdf
    • https://static.s123-cdn-static.com/uploads/4389823/normal_5fe15caca369e.pdf
    • https://cdn-cms.f-static.net/uploads/4417807/normal_60250dc3b9c42.pdf
    • https://static.s123-cdn-static.com/uploads/4365570/normal_5fc6d8de8bde8.pdf
    • https://cdn.sqhk.co/vinogusi/ihggzhg/call_of_spartan_mod_apk_3._6._7.pdf
    • https://cdn.sqhk.co/mojubemuwek/giiagfx/steven_universe_quiz_what_homeworld_gem_are_you.pdf
    • https://static.s123-cdn-static.com/uploads/4501996/normal_60060e3188bb9.pdf
    • http://im-marceting.site/the_cask_of_amontillado_vocabulary4xvm2.pdf
    • https://cdn.sqhk.co/zanivuwiduvo/c9ggsRB/12669020514.pdf
    • https://sigoberedida.weebly.com/uploads/1/3/4/5/134594083/gofumozaladore.pdf
    • https://pamukisap.weebly.com/uploads/1/3/4/7/134761215/lilafibejojiw-buxafafalujaj-monujolirawem.pdf
    • https://cdn-cms.f-static.net/uploads/4485569/normal_606d93a5c7582.pdf
    • https://dijalotujut.weebly.com/uploads/1/3/4/7/134713382/sovamagetovon.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d6fd85e7-dd56-44a2-a762-5d9ae48af8ba/what_are_the_greek_god_pan_powers.pdf
    • https://uploads.strikinglycdn.com/files/7728f295-aa3d-4daf-8421-61d62ab9eac1/roblox_id_code_for_older.pdf
    • http://sekuwomexapa.myartsonline.com/howls_moving_castle_book_barnes_and_noble.pdf
    • http://duxegejuw.atwebpages.com/76085702879.pdf
    • https://uploads.strikinglycdn.com/files/05eadba5-595f-499b-9263-c50e77c9b545/2003_kawasaki_bayou_250_carburetor_adjustment.pdf
    • http://ropupifalapoges.atwebpages.com/xolubasomufirepusixeleli.pdf
    • https://uploads.strikinglycdn.com/files/9db46309-2ef1-4af8-8a6d-bf7ef76e3dd4/57188411518.pdf
    • http://pikubub.onlinewebshop.net/busaferedusirimemuw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102d2.bin
3c01a27bb7f2f53878d2af239aed90443eaf4365aeb78249c62b31479fcc6fcc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102D2 5304 bytes
font_01_sfnt_off000114da.bin
307697845a92e8b8112fd6d1dfa15f6ae07e5a88597b898abd01a9116b4a7ec2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114DA 12684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.