Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6ec3854a093997b…

MALICIOUS

PDF

77.8 KB Created: 2021-04-01 01:34:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 20912bc69c4a6db6fa1403fe9cc4be24 SHA-1: 8022dabfb21051e6c4509ac087a14f35803ab0b5 SHA-256: b6ec3854a093997b52d9e002138e21af8d7824f1b01e44436193c573784f220a
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier indicating maliciousness. The presence of external URIs and a link farm on disposable hosting suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a date, but no clear textual lure was extracted.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/aws?utm_term=norcold+refrigerator+not+working+on+propane PDF link annotation
    • https://sozazajigosana.weebly.com/uploads/1/3/0/7/130739782/93dd47d25052189.pdfIn PDF document text
    • http://fozivot.mypressonline.com/45466302482.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456389/normal_605279c3ee914.pdfIn PDF document text
    • http://botefin.medianewsonline.com/10328874506.pdfIn PDF document text
    • http://ramuwesitavoz.mywebcommunity.org/73598855472.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494136/normal_604f7acb364f8.pdfIn PDF document text
    • https://nufodovepitad.weebly.com/uploads/1/3/4/7/134718778/8823146.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://a7ed8af5-5e4a-4eaf-98d7-51655494ca15.filesusr.com/ugd/b5c45a_29e02898c1fa4f009b65fa4287bd008a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/aeab549b-f931-4075-8f9b-75af6fa43551/how_to_read_surah_al_mulk.pdfIn PDF document text
    • https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_269b8ee049934d469846d05ad581becc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/niporofez/accident_report_form_for_schools.pdfIn PDF document text
    • https://2ea9429b-0332-4ee6-bb75-ab9535b56c99.filesusr.com/ugd/e2f7e1_04a9a45d13f244088a4b018886e092b4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tesotiwapax/is_the_canon_rebel_xt_a_dslr.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e35957d6-16f0-444c-8def-f04ca3321ce3/xejafutijimagaves.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdb2bad4-1a3b-4f27-9a1f-2f24d7bd3b28/80617179569.pdfIn PDF document text
    • https://4a1cfc67-5981-466d-a13b-75576fe7431f.filesusr.com/ugd/64e449_ea844dd5b0364538b5c7a495dd080610.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c981c1ac-811c-4ef1-8709-3e3c05ddda9a/91090746656.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d9bfbb8-7efb-48e2-818e-74602dc49dcd/tipakajelidozalekadi.pdfIn PDF document text
    • https://s3.amazonaws.com/voxipanovigepiv/guvodokuposinebiluje.pdfIn PDF document text
    • https://44034db3-6cdd-4729-adf3-7ccd6afcf354.filesusr.com/ugd/9fe9cc_ccfb57f3eef0459daded9d4c83e11274.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/toniseligiwuzux/kuxemosudom.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f049.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF049 5272 bytes
SHA-256: 5c52ea4ca6c339a8f1a66f35a43e72747e64ac357c46172d44812d1a2a25d924
font_01_sfnt_off0001025f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1025F 11276 bytes
SHA-256: 2535b50bf5ed3d2582bf154f2c8c1f9aaf868e423b3bd6ed55e93d7e4205f3d7

Open this report in the interactive analyzer, or submit your own file for analysis.