Malicious PDF — malware analysis report

Static analysis result for SHA-256 b752a5e3a4b66335…

MALICIOUS

PDF

77.2 KB Created: 2021-03-19 20:26:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: c431deafa00600d362d1f8041000875a SHA-1: cb657181fe7c98b6eaa5b386092d6832085b663a SHA-256: b752a5e3a4b66335d4be7b1e4b2633a7db8af0eabd33e3c8de747d66fd84663f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The file contains numerous external URIs, with one pointing to a link farm on disposable hosting, suggesting a phishing or redirection attempt. The presence of embedded URLs and the overall structure align with spearphishing attachments used to direct users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=immunity+and+disease+worksheet PDF link annotation
    • https://cdn.sqhk.co/zowajomi/gdA8lgd/44078441847.pdfIn PDF document text
    • https://cdn.sqhk.co/zozusexub/jbJijuG/89357437882.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478422/normal_604949723ef82.pdfIn PDF document text
    • https://cdn.sqhk.co/luxixumogez/W3HXhic/miracle_on_34th_street_1947.pdfIn PDF document text
    • https://sivajusirev.weebly.com/uploads/1/3/0/8/130814673/dotalokop_mojatuliwub.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409254/normal_5fedd15c12faf.pdfIn PDF document text
    • https://cdn.sqhk.co/guwaloxipete/fiahghi/how_did_you_learn_english_in_spanish.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474471/normal_5fe3070994311.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470412/normal_604c9871a4775.pdfIn PDF document text
    • https://cdn.sqhk.co/tatogevi/jbjg7Sj/na_remote_for_dune_hd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4418199/normal_5ffb6fc8b0b75.pdfIn PDF document text
    • https://xipasole.weebly.com/uploads/1/3/4/8/134853136/laruzex.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6db56a4-05da-4c81-9cf7-c27af106d30b/first_aid_usmle_books.pdfIn PDF document text
    • https://7f1d4f38-7308-4051-b389-b8ed31312188.filesusr.com/ugd/e948c1_e22f7f346e7c4d878e8e9f35b048b4d3.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1900a2c-01c1-4c11-b050-50857068586e/how_do_you_make_alfredo_sauce_with_milk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19822473-2f70-4900-b6a9-4baab5f511bb/visezekagilelepozise.pdfIn PDF document text
    • https://c78ffd2e-fc3d-4272-86ca-968d835fb7ad.filesusr.com/ugd/0f9ef0_6e97263d27c1430487f9696fb71a051d.pdf?index=trueIn PDF document text
    • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_44979689fa5f4881907d9fd46f69f708.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/49a799f2-272b-4526-9dfa-ee5cb0099c64/satizelaxofepibegupofusu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8db41a37-154d-4946-8cea-60ebb2c644ee/vavexovijexeton.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f22b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF22B 5228 bytes
SHA-256: 80aff349e7085f92124054a30b0cd1dfdf5669b8e572286a50c646c84361d816
font_01_sfnt_off000103db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103DB 10412 bytes
SHA-256: b868fbc34c7483de6a1db80fed4ea0143797c517c8765dc91900e8fd31ba3cf7

Open this report in the interactive analyzer, or submit your own file for analysis.