Malicious PDF — malware analysis report

Static analysis result for SHA-256 c13d3387b2f6062c…

MALICIOUS

PDF

78.8 KB Created: 2021-03-18 11:31:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: a07c634fbc8e8d7485279b1b656ce1aa SHA-1: 4adc482de4037e769c5fa1d7da4d12090848d75c SHA-256: c13d3387b2f6062c2f163a30c8686cb5b23f36b349f6ddc81cff210aac5c74b2
146 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link T1059.007 JavaScript

The PDF contains numerous embedded URLs, many pointing to disposable hosting, suggesting a link farm designed to redirect users. The 'SE_ENABLE_LURE' heuristic indicates the document likely prompts the user to enable content, a common tactic for malware droppers. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=word+selection+is+locked PDF link annotation
    • http://rosebip.22web.org/69934552386.pdfIn PDF document text
    • https://cdn.sqhk.co/ripalufix/ghiecjf/mill_s_four_arguments_for_freedom_of_speech.pdfIn PDF document text
    • http://faxadiweruxu.22web.org/vorabikusobigif.pdfIn PDF document text
    • http://nukotim.iblogger.org/pelivedorudufeze.pdfIn PDF document text
    • https://cdn.sqhk.co/salozudat/hmQf1jj/31840195227.pdfIn PDF document text
    • https://cdn.sqhk.co/vovigewuva/fpgekCs/retroarch_switch_controls.pdfIn PDF document text
    • http://bawazofo.getenjoyment.net/how_to_learn_finance_basics.pdfIn PDF document text
    • http://saudiautoinsurance.com/15833210488abulh.pdfIn PDF document text
    • http://jabakibiv.iblogger.org/paleodieta_completo.pdfIn PDF document text
    • https://cdn.sqhk.co/kidatufo/ijghcib/66413386081.pdfIn PDF document text
    • http://italy50wow.pro/is_big_little_lies_on_netflix_or_primeetlpl.pdfIn PDF document text
    • http://alex-chekalev.com/biopac_emg_lab_reportl0bxv.pdfIn PDF document text
    • http://dayzcommunity.info/regofizunuxinoforaxiwel686wn.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://filutapokupa.epizy.com/47345203934.pdfIn PDF document text
    • http://sapoziwuzodol.rf.gd/alcanos_en_la_vida_cotidiana.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8235b31-d81e-449e-b9e2-f70c71d38df3/bless_me_ultima_chapter_15-17_summary.pdfIn PDF document text
    • http://sitolomuku.epizy.com/kilitida.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a870e703-d6a0-4007-adff-378e99ede818/65884097576.pdfIn PDF document text
    • http://sebokegekesuded.atwebpages.com/11964001563.pdfIn PDF document text
    • http://kibowetesuve.rf.gd/brick_masonry_nptel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5bd5323-7ee4-41df-b40e-04b1e597576b/smart_board_mx_series_cost.pdfIn PDF document text
    • http://lamerowed.rf.gd/17365411358.pdfIn PDF document text
    • http://jatoxat.atwebpages.com/reading_skills_notes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/101f01cb-4e3f-4993-bcbc-a7351b18ccc6/1716719689.pdfIn PDF document text
    • http://libizokize.rf.gd/how_to_use_hamilton_beach_brewstation.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9DF 4800 bytes
SHA-256: eda95e285d980674ec64dfa8be0207ab6143987f2387e135b18f1616f9f89608
font_01_sfnt_off00010a52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A52 10444 bytes
SHA-256: db36dc93af7f481864a60a7187065dacbbdd8270cdb9d62cc6acbfd2397304e5

Open this report in the interactive analyzer, or submit your own file for analysis.