Malicious PDF — malware analysis report

Static analysis result for SHA-256 be9d0836073c1fb9…

MALICIOUS

PDF

81.7 KB Created: 2021-04-11 09:46:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 55c918d14523e77622fc8f3c15aeb107 SHA-1: d8dc769f0319d24a3fc4f56f02d6d1df23b28908 SHA-256: be9d0836073c1fb990ec1ddafa608c4f1a920406f7fa94e348dd3b3f67bdfa6e
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many hosted on disposable domains, suggesting a link farm or phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as a phishing trojan. The document body, though heavily obfuscated, contains text related to personal injury claims, aligning with the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+long+can+personal+injury+claims+take
    • https://cdn.sqhk.co/xenaporo/hfKjcjf/madness_combat_10_sprite_sheet.pdf
    • http://eroganoficial.site/free_tetris_game_for_windows_10w7o4v.pdf
    • http://picply.ru/stephen_king_the_mist_ending_book5p9cq.pdf
    • http://boost-store.net/application_format_for_obtaining_noc_from_societymmxev.pdf
    • http://medicinfo.online/vetizakuguvoleg0febj.pdf
    • http://lnstagramverifiedsbadgesforms.com/fimebepusemotipumopwm24.pdf
    • https://cdn.sqhk.co/fubemabofof/hFhaiiN/chuteira_de_ouro_europa.pdf
    • http://slimitalia.space/color_by_number_new_coloring_book29e7s.pdf
    • http://fallofelin.online/maze_runner_3_full_movie_free_onlinef6e00.pdf
    • http://bluebadge-support.com/vobipujaduxeniloxologilo1i03d.pdf
    • https://cdn.sqhk.co/doparibi/ghegcjd/79043762487.pdf
    • http://fortuneo.biz/all_guitar_chords_book9b6sv.pdf
    • https://cdn.sqhk.co/pijovowifil/icHjfRe/kakareva.pdf
    • https://cdn.sqhk.co/mixaluwekitu/idI0Hge/57080411743.pdf
    • http://ses-sanobrabotka.ru/cfa_level_1_exam_results_december_2019zobnm.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0029a690-d003-4268-bdc7-e74daa5a0415.filesusr.com/ugd/a4b355_6f3219f8b0ed421a80677042c51b13be.pdf?index=true
    • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_cfae0d9e3e914f148ceb218c402c9cb8.pdf?index=true
    • https://a1359116-1358-4cde-afc5-3600b4bb50db.filesusr.com/ugd/3b0c81_099e67d74e6f4706862efe36bc87d07d.pdf?index=true
    • https://s3.amazonaws.com/welanisowari/kugam.pdf
    • https://s3.amazonaws.com/xoguwavosuje/performing_a_blood_smear.pdf
    • https://cee4a208-09ac-40e0-983f-4c2cc776acbe.filesusr.com/ugd/5ed537_b55a79dcb3484cdaa72ff69ab22e4db8.pdf?index=true
    • https://170d08c7-2527-4f8e-8bc4-cf7f6ffab704.filesusr.com/ugd/afe24e_9f77aefa329a4f7db984d4898744d4d3.pdf?index=true
    • https://s3.amazonaws.com/ragejufa/fudonipulisokalowategaje.pdf
    • https://235a1a37-2bc9-4d3b-8f1d-d3952ad9fba8.filesusr.com/ugd/3111f7_b42287a2991b48ab869a5347fba18463.pdf?index=true
    • https://s3.amazonaws.com/sorapobuk/taselobojo.pdf
    • https://1b6fbac1-9b66-4609-9151-81f5d4c316f7.filesusr.com/ugd/5e81b9_074414cad7ea454db24a3c10c888a62d.pdf?index=true
    • https://medlineplus.gov/backinjuries.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010144.bin
08bf7549c5342f34eb8b57c14eeb85df9cf40b1e3754eab3754ce80f5257a40e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10144 5548 bytes
font_01_sfnt_off0001142f.bin
94b68714cb0e7851ab5eb7feae60430e3a3e031d17938a4cd52fac3dd1f34c96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1142F 10748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.