Malicious PDF — malware analysis report

Static analysis result for SHA-256 be17abd4f2d526a7…

MALICIOUS

PDF

75.7 KB Created: 2021-03-29 10:36:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d2e607a5f9ee2516239f6056a43c8351 SHA-1: b4125e24b9dbd9e5447ef55ee46f4a3d7559b267 SHA-256: be17abd4f2d526a7a595db419bc4b561c8c5e9c28072393c1b9794e976b3be85
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded JavaScript and multiple external URIs, with one specifically identified as a link farm on disposable hosting. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect users to phishing or malware-hosting sites. The embedded JavaScript is a common technique for initiating malicious actions within PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=ielts+writing+task+2+topics+academic+with+answers+pdf+makkar
    • https://cdn.sqhk.co/tatudawo/3Ijf4m2/10382672434.pdf
    • http://povujusuwaveva.iblogger.org/99443682507.pdf
    • https://cdn-cms.f-static.net/uploads/4480905/normal_60329ad0e892e.pdf
    • https://cdn-cms.f-static.net/uploads/4473384/normal_6013ba7db2c35.pdf
    • https://cdn-cms.f-static.net/uploads/4421476/normal_605d94408ae54.pdf
    • https://cdn-cms.f-static.net/uploads/4447276/normal_604d991251da9.pdf
    • https://cdn.sqhk.co/fabetojowuje/gcROF93/67362956462.pdf
    • https://cdn.sqhk.co/gafazakedoki/hAhe6je/xidobubatafupavopelexovaf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/fe2a9e61-c84f-402c-a211-f39a3cf1cbe3/causes_of_big_pimples_on_forehead.pdf
    • https://uploads.strikinglycdn.com/files/9f8469f6-44c8-4a3a-ac0d-78daed032e8b/681169884.pdf
    • http://bilunijo.epizy.com/88749331262.pdf
    • http://nonavijewiw.epizy.com/78419834936.pdf
    • http://xidesaso.rf.gd/ubiquiti_nanostation_m2_configuration_as_access_point.pdf
    • http://fatewazut.epizy.com/boll_n_branch_sheets_reviews.pdf
    • https://uploads.strikinglycdn.com/files/e4531985-22c3-4d0e-85d3-2301ee55b3d5/nurujavavuzesegodelageduv.pdf
    • https://7e073981-ad1c-4081-8dc0-76946ba36063.filesusr.com/ugd/c4f63d_0a92efeb636444f086043c7298934cfb.pdf?index=true
    • http://midexudotag.epizy.com/negajunitaligeza.pdf
    • https://a4edf7fa-b057-49b5-8014-e5fd436fbef3.filesusr.com/ugd/c8b2c5_e67c5fb3b5894a9fa9a950c1db43fe0b.pdf?index=true
    • http://jegozejixal.epizy.com/xuwenuderikobofoko.pdf
    • https://1f2f8e77-98df-4c5e-b88a-83bc2b612b58.filesusr.com/ugd/5c7528_86fa7428a3ec4cd6afadc3a1ae2e8dbc.pdf?index=true
    • https://9f53eded-325d-4e02-8430-7c09bd872488.filesusr.com/ugd/e04405_8d98db3270074bd7a3bf1827ed92f063.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b5164e47-a7d5-489e-8580-e5f646bcd372/zemamurubur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb24.bin
7d9ed933b471af6c7570096eeec4212e3100195431d3b9f1177f226f98b737b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB24 5796 bytes
font_01_sfnt_off0000fec9.bin
b221e6f5296ca2854f9639ec36a20294ade0926c5a6f5b124a428a9616c996f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEC9 10160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.