Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4309bb103c2316d…

MALICIOUS

PDF

70.0 KB Created: 2021-03-30 05:55:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 2a0af302a00333a0f2b5d796976c03cc SHA-1: 52a667f0aef74c7546b97d4730ff947cde3caebd SHA-256: c4309bb103c2316dbb5d55af49ad53cf56f68c195270de2affd9fc88165e0608
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external URIs pointing to disposable domains and link farms, a common tactic for phishing and malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to deliver a second-stage payload via one of the embedded links. While no scripts were explicitly extracted, the PDF structure and URL patterns suggest it is designed to trick users into downloading malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=green+flyer+background+template PDF link annotation
    • http://mebovedu.getenjoyment.net/1076988081.pdfIn PDF document text
    • http://lorewipa.scienceontheweb.net/poboravipogatutonixufi.pdfIn PDF document text
    • https://lazofakivew.weebly.com/uploads/1/3/1/4/131406449/renaru.pdfIn PDF document text
    • https://xidokuwu.weebly.com/uploads/1/3/1/4/131453793/nemifetoxesadezufoj.pdfIn PDF document text
    • https://wezalowesugalu.weebly.com/uploads/1/3/2/8/132815960/25b01.pdfIn PDF document text
    • http://leziwazedo.mypressonline.com/deroru.pdfIn PDF document text
    • http://vesajob.getenjoyment.net/latex_mathematical_symbols.pdfIn PDF document text
    • https://cdn.sqhk.co/dedejosewor/dHqGtgd/76112046332.pdfIn PDF document text
    • http://sawedes.mywebcommunity.org/is_rpg_maker_vx_ace_free.pdfIn PDF document text
    • https://cdn.sqhk.co/rowalulo/JjjZ8P7/horizon_modding_kernel_apk.pdfIn PDF document text
    • https://revabusabozuvum.weebly.com/uploads/1/3/5/3/135398016/f807031adc92.pdfIn PDF document text
    • http://katipef.medianewsonline.com/70476051627.pdfIn PDF document text
    • https://pamimimafe.weebly.com/uploads/1/3/0/7/130775080/b362a29b9e7e82b.pdfIn PDF document text
    • https://cdn.sqhk.co/fomanazoravu/jcicgiO/61188165263.pdfIn PDF document text
    • http://kawasus.scienceontheweb.net/what_type_of_charger_cable_for_kindle.pdfIn PDF document text
    • http://vufajed.getenjoyment.net/39146050879.pdfIn PDF document text
    • http://vakexuk.22web.org/76438755859.pdfIn PDF document text
    • http://xelirap.22web.org/33690959817.pdfIn PDF document text
    • http://pevewoxoxup.scienceontheweb.net/lolupuge.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zapuvem.epizy.com/christian_apologetics.pdfIn PDF document text
    • http://baverasoge.epizy.com/lavender_town_music_sheet.pdfIn PDF document text
    • http://jozobudesurarab.onlinewebshop.net/bls_provider_manual_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d34e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD34E 5636 bytes
SHA-256: 3a2ad8a7cec1b3f6c3946efa694bc2c7da7e58b9a8d49d988fa60d6b0db340a6
font_01_sfnt_off0000e675.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE675 10704 bytes
SHA-256: 39da4dd0686e68872efdd108b6cf4022a27573c4ba6dd06f443470c12a95e041

Open this report in the interactive analyzer, or submit your own file for analysis.