Malicious PDF — malware analysis report

Static analysis result for SHA-256 c039fc8ec99dcdf4…

MALICIOUS

PDF

66.5 KB Created: 2021-03-15 17:59:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f59514125b0a8cf81ed0dc871d75c3c1 SHA-1: 79d60fb85ac90c7ccd41536afe18ef39079f7160 SHA-256: c039fc8ec99dcdf445a4d0d32f2ed5a4f1dc775beb27562b1fee4f4ba9dc849d
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and heuristics indicate it is a link farm on disposable hosting, with a high ML score and ClamAV detection pointing to malicious intent. The document body, though heavily obfuscated, suggests a lure related to a 'golden high school bell schedule' to entice users to click on the malicious URL. No scripts were extracted, but the presence of external URIs and the overall detection suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=golden+high+school+bell+schedule
    • https://static.s123-cdn-static.com/uploads/4377933/normal_5fceb57034a9b.pdf
    • https://cdn-cms.f-static.net/uploads/4484375/normal_601abbad58f5c.pdf
    • https://static.s123-cdn-static.com/uploads/4423471/normal_5fcc044bdc62f.pdf
    • http://idealica-official-it.website/11436634353idepn.pdf
    • https://cdn.sqhk.co/dodamewope/chejfcS/juletume.pdf
    • https://cdn.sqhk.co/mivijigonof/ijxsVig/easter_road_death_toll_2020_south_africa.pdf
    • http://arthromedshop.xyz/which_of_the_following_is_the_energy_of_a_moving_object860pa.pdf
    • http://albatros-trans.ru/life_fitness_x5i_elliptical_reviewvl326.pdf
    • https://static.s123-cdn-static.com/uploads/4461245/normal_5ff35df492e90.pdf
    • http://fit-italy.space/ashtanga_vinyasa_hatha_yoga_diferenciasivz0c.pdf
    • http://medway24.com/zuvetoxaveboregojf52gs.pdf
    • https://cdn.sqhk.co/mezutorixo/jJnhbhc/tuzovugefolepuxugamoxugat.pdf
    • https://static.s123-cdn-static.com/uploads/4369664/normal_5ff2699b5f08b.pdf
    • https://cdn-cms.f-static.net/uploads/4368997/normal_5fda62ab1c3dd.pdf
    • https://cdn-cms.f-static.net/uploads/4393361/normal_6020ca31d61bd.pdf
    • http://amorexpo.com/38483634068s7k6a.pdf
    • http://lnstagramverifiedsbadgeform.com/cute_dolls_hd_wallpapervjnrf.pdf
    • https://cdn-cms.f-static.net/uploads/4376611/normal_601a4557d6aa0.pdf
    • https://cdn.sqhk.co/bebuvasipen/TpEYZhg/how_to_draw_easy_cartoon_dog.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f5024c3d-05e9-447c-b280-86abbff6bcae/xurutabovosimu.pdf
    • https://uploads.strikinglycdn.com/files/4ca57376-113f-4288-9ccf-5b3aa5fb8fbb/85592726155.pdf
    • https://uploads.strikinglycdn.com/files/448cd885-fc13-4e6b-9e32-e1db5228f155/tekonsha_prodigy_p3_brake_controller_manual.pdf
    • https://uploads.strikinglycdn.com/files/60ab4f99-4263-4f28-8316-e585f0702294/47976546317.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c920.bin
797ef33211e69cb97cf44cb6ec4139ef931268104ba13c906f3b36f30746640e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC920 5064 bytes
font_01_sfnt_off0000da5b.bin
fcf90005a3044589aaeb245ee137dfdaba945cae77a8f43305c658433756f138		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA5B 9924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.