Malicious PDF — malware analysis report

Static analysis result for SHA-256 c698e615966a10b5…

MALICIOUS

PDF

81.7 KB Created: 2021-05-18 01:11:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f69e762e3046aa10dd0c2c3716ccf257 SHA-1: d1e75b9fbd5aa45eed5455e05ef4ca4df91763c2 SHA-256: c698e615966a10b51f9488e748193233640debcda3deee37b58f14b4a5e4874d
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs pointing to disposable hosting, indicating a link farm designed to redirect users to potentially malicious sites. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a book title, suggesting a lure document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=the+millionaire+mind+book+summary+pdf
    • https://vuwawirekexaz.weebly.com/uploads/1/3/0/9/130969699/9aa28fe4ea65ad4.pdf
    • https://bazeneta.weebly.com/uploads/1/3/0/8/130813787/tekedegojekelu.pdf
    • http://dusosax.66ghz.com/zimazafozukutelagepava.pdf
    • http://vudatibapikapak.22web.org/strengthening_exercises_for_lower_back_pain.pdf
    • http://bujupete.iblogger.org/6755668027.pdf
    • http://kobujiva.iblogger.org/niv_study_bible_large_print_genuine_leather.pdf
    • https://jawogebewo.weebly.com/uploads/1/3/4/3/134369376/xepedubanifi-fomuxetala-fegufuzexamuz-felajemewiboma.pdf
    • https://giwirakixa.weebly.com/uploads/1/3/3/9/133999144/419139.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/muvarelo/best_story_books_to_read_in_tamil.pdf
    • https://uploads.strikinglycdn.com/files/26433406-da4a-43c7-bc09-09d33e50d8f9/lick_lick_lick_lyrics_cupcake_song.pdf
    • http://siletafelit.epizy.com/70243607614.pdf
    • https://s3.amazonaws.com/nerugiraxura/grafana_template_variable_elasticsearch.pdf
    • http://xevorerokune.epizy.com/eclipse_36_honing_guide_for_sale.pdf
    • https://s3.amazonaws.com/waxegatulo/giseno.pdf
    • https://uploads.strikinglycdn.com/files/986ef51f-4b77-40bd-9181-acd099f3b2ee/5540868230.pdf
    • https://uploads.strikinglycdn.com/files/4d680a67-0647-4e34-97e5-cfb857cf6b90/46879139568.pdf
    • http://xoxuvenopojox.rf.gd/arduino_bluetooth_android_graph.pdf
    • https://uploads.strikinglycdn.com/files/04df5e3f-e575-42be-8723-c85117c151fb/muxipawuwororineruzafenif.pdf
    • http://kanisal.epizy.com/kutivavarumiwekifo.pdf
    • https://s3.amazonaws.com/zamemigojat/kmsauto_activator_windows_10.pdf
    • https://uploads.strikinglycdn.com/files/e4f42061-c0fe-4f76-b1c0-7591da582179/dasobogivawonosod.pdf
    • https://s3.amazonaws.com/tanikanaw/jiburakaxulopak.pdf
    • http://lagadasisipas.rf.gd/tebibanekebufikosufemulut.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f43e.bin
509dd43469ba1b1880871315e4b1a7c1ec67bd4c861fdda6a8e83e4b251c8666		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF43E 5340 bytes
font_01_sfnt_off00010632.bin
5220db8d8b263671cd5adcb9425fde6b2bdd9f7a82bca8c84bf7ba2befa6c8ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10632 10984 bytes
font_02_sfnt_off00012b62.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B62 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.