Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd296876750dff14…

MALICIOUS

PDF

77.8 KB Created: 2021-03-15 20:09:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: dde365ba3a02fec7c44b4d9339072158 SHA-1: 233c59708b7a07ed175d917446b6db7b0e860161 SHA-256: bd296876750dff14a1688092b4c70b8bae6ef5286fcc6d9668a25d89845d9bff
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external URIs, with one specifically identified as a link farm on disposable hosting, suggesting a phishing or malware distribution scheme. The presence of embedded URLs and the overall structure point towards an attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=project+flow+chart+template+powerpoint PDF link annotation
    • https://cdn.sqhk.co/susononuz/Pgfibq2/meteor_shower_calendar_2020_uk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409255/normal_6028e67f001e8.pdfIn PDF document text
    • https://wavurujubatebar.weebly.com/uploads/1/3/2/6/132682053/kaxikonubuxijuzeg.pdfIn PDF document text
    • http://tadurarawi.mypressonline.com/catalina_rivas_libros.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4468550/normal_5fe46db723e4f.pdfIn PDF document text
    • http://pirawelu.iblogger.org/samsung_un32n5300afxza_32_1080p_smart_led_tv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402933/normal_5fd5f52f7badf.pdfIn PDF document text
    • http://dawexefif.getenjoyment.net/cause_and_effect_paragraph_worksheet.pdfIn PDF document text
    • https://kaxebovirufuj.weebly.com/uploads/1/3/4/3/134399635/pekax.pdfIn PDF document text
    • http://zofunubesosena.mypressonline.com/present_perfect_just_already_and_yet_exercises.pdfIn PDF document text
    • http://jorowijedo.mywebcommunity.org/what_does_arrested_development_mean_in_biology.pdfIn PDF document text
    • https://cdn.sqhk.co/dikabopagesi/gcTggjj/a_couple_of_forevers_fakaza.pdfIn PDF document text
    • https://zazalefofano.weebly.com/uploads/1/3/4/5/134578352/8335742.pdfIn PDF document text
    • https://cdn.sqhk.co/vifutetax/ibihhac/racing_classics_pro_drag_race_real_speed.pdfIn PDF document text
    • https://cdn.sqhk.co/barugogip/kjbFjd2/28449517158.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://ledufowi.myartsonline.com/china_anti_monopoly_law.pdfIn PDF document text
    • http://juxudawalugevop.epizy.com/jomusowaluzexizivew.pdfIn PDF document text
    • https://50aad03f-9d2a-47e6-be13-abd12f321b17.filesusr.com/ugd/3fd638_342874fd1c084f12bfbb23935a3d7e04.pdf?index=trueIn PDF document text
    • http://wodurijije.epizy.com/sinadapokukasepi.pdfIn PDF document text
    • https://df6a9abb-74f3-47e1-b359-fe6d1019da36.filesusr.com/ugd/7921d2_f3e7b3b7445148469ddbec620c6ef178.pdf?index=trueIn PDF document text
    • https://1d942ef5-affb-47d8-8f99-70a3d187b733.filesusr.com/ugd/3283b0_d09e97244bee439e90b90c085b487b57.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3AC 5248 bytes
SHA-256: 657004555607e710f194d5919d219d801b7be94e014605fbac063e655dc63d1f
font_01_sfnt_off00010570.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10570 10572 bytes
SHA-256: 217d3ab7d46e72f2809635e47b2d0ed5dd065c6f3b8266c383dd9c2ba172b854

Open this report in the interactive analyzer, or submit your own file for analysis.