Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1f030d28ff5d431…

MALICIOUS

PDF

84.4 KB Created: 2021-03-23 16:13:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: f234d980b4d40927b8f996e09c3dbafe SHA-1: 68b85aaa74548b5e0b8357b5ac07bda5d889c8b5 SHA-256: c1f030d28ff5d4314273c37d0e6d9b6838c9291918e6e2519893ab143de11daa
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains multiple heuristics indicating suspicious link behavior, including invisible links pointing to potentially malicious domains like http://com-login8.xyz/. The document also acts as a link farm, directing users to various external sites, some of which are hosted on disposable domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=referencias+bibliograficas+pdf+apa PDF link annotation
    • https://jiwifibim.weebly.com/uploads/1/3/1/4/131437351/vozina.pdfIn PDF document text
    • https://digexuvin.weebly.com/uploads/1/3/2/8/132814990/fuzuxumuz-tixugi-tedofujobateku-dazibotolute.pdfIn PDF document text
    • http://oneitstore.info/can_you_get_form_ssa_1099_online1wyso.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403676/normal_6001445094902.pdfIn PDF document text
    • http://sodalabs.pro/how_to_put_a_plastic_collar_on_a_dogzof3z.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421049/normal_602ba5a764759.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420237/normal_600941a7cbb01.pdfIn PDF document text
    • https://wuwabisa.weebly.com/uploads/1/3/1/6/131606234/f5112d9b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479942/normal_5fe2eae0dd753.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426408/normal_60170dd6ea5d8.pdfIn PDF document text
    • https://rimofemosi.weebly.com/uploads/1/3/4/3/134351632/kidiwigip-jerutoj-fopur.pdfIn PDF document text
    • http://com-login8.xyz/chinese_zodiac_movie_english_audio_trackawrp8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376120/normal_6027549635472.pdfIn PDF document text
    • http://heleogose.online/tonosobev5422q.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417983/normal_5ff78f6c791b8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/1e94a1b5-733a-42aa-aaaf-19d353a79ef8/why_is_my_dymo_4xl_not_printing.pdfIn PDF document text
    • https://s3.amazonaws.com/mibiwivanetuj/best_emulator_for_android_studio_amd_processor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/85eb9245-c099-4fee-a240-ee61f9b51ba1/slow_learning_processing_disorder.pdfIn PDF document text
    • https://s3.amazonaws.com/gulapore/nexaxubipowemere.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e5132ac-a93a-45ee-8a44-f93aeb225363/kalowel.pdfIn PDF document text
    • https://s3.amazonaws.com/sesafefanulokam/bee_er_app_new_version.pdfIn PDF document text
    • https://s3.amazonaws.com/geradi/jolly_phonics_reading_books_level_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c35bb3a-cd12-4a25-b8b6-99b4270d14ed/22259518196.pdfIn PDF document text
    • https://s3.amazonaws.com/kudowo/sutopisafapakop.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8DD 5176 bytes
SHA-256: d365ede5c4ba156f7d80ac7d12c63052b6b8bc76587e8787d96f20b7a39a114e
font_01_sfnt_off00010a76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A76 12876 bytes
SHA-256: 6ba3e126f15726dc4833d5fe5a32f9269c59afe89565fef380a300a4c0a7b0e5
font_02_sfnt_off00013408.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13408 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.