Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7d6b8d3dd5f7f4d…

MALICIOUS

PDF

81.4 KB Created: 2021-03-23 15:43:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 51bb7d5f0a42d104bf8b555972694d56 SHA-1: 77bb55238a9007cc2ebc062d71d004d8f03822fa SHA-256: c7d6b8d3dd5f7f4d251394dd845b71e8873960a96ff6048627781b116cff03cc
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan threat. It contains numerous embedded URLs, many pointing to disposable hosting and employing UTM parameters, suggesting a link farm designed to redirect users to malicious sites. The document body, though heavily obfuscated, appears to contain keywords related to product manuals, likely a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=presto+02141+6-quart+electric+pressure+cooker+manual
    • http://trokot-tonirovka.online/uno_card_game_for_mobileceaci.pdf
    • http://rankingcoach-seo.com/33212908454dlfx6.pdf
    • https://cdn.sqhk.co/pigujoxexate/hiuhhhd/slots_free_play.pdf
    • http://cyberlife.store/kaloxofxltk.pdf
    • http://it50save.info/afunika_latest_songs_2018f4lyh.pdf
    • https://cdn.sqhk.co/waketeni/cihRbii/63073161622.pdf
    • https://cdn.sqhk.co/vopupevomate/hjifijZ/40371337072.pdf
    • http://stroymarketmetal.ru/how_to_clean_new_construction_hardwood_floorswew8v.pdf
    • https://cdn.sqhk.co/waxolulum/Gfgjjco/words_that_start_with_h_funny.pdf
    • http://dressnbuy.com/loderijikewodiweg0vrvl.pdf
    • http://tells.fun/38952788166qkt0h.pdf
    • http://tekplafond.xyz/format_factory_setup_32_bitueqlv.pdf
    • http://maska-respirator.shop/judatumorunodaat9uj.pdf
    • http://xtina.online/31487005737gnfz8.pdf
    • http://uscarins.info/tying_knots_in_thick_rope4uzvj.pdf
    • http://on24-system.club/42195042362kad9p.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a7193630-a032-4ee2-b136-33837135b76a.filesusr.com/ugd/fac845_52aafa2aa1a24bc0ae1b77a32642baef.pdf?index=true
    • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_47902fa802f84a569d2ba200e932c1ef.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a32e2948-7b88-4275-8086-a1d4d1a1889c/sefijomaz.pdf
    • https://uploads.strikinglycdn.com/files/476eb653-ccb7-41a4-8329-466c1b527f1f/40162874931.pdf
    • https://uploads.strikinglycdn.com/files/6571676f-e3ff-4c29-99eb-c77b2de5c964/model_3_long_range_performance_update.pdf
    • https://4cf2acc4-d143-4013-a78d-f21de0873c4f.filesusr.com/ugd/e4636f_23d9f21bd4034736a8033439da25c263.pdf?index=true
    • https://da89e6ec-52f9-4c28-8de8-447a2e923c0c.filesusr.com/ugd/5e5b2a_d82bbd38fe204608afa84770e6acd9db.pdf?index=true
    • https://uploads.strikinglycdn.com/files/87497595-dc71-4aa7-9955-3af25a1ecbf9/eragon_movie_download_mp4.pdf
    • https://uploads.strikinglycdn.com/files/72a93671-ca05-4c8b-a293-fd44129e8faa/but_how_do_it_know_book_review.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe3e.bin
326ebe6fdb11ffc7651cdd5c20aad3bc646fd0b10dca47e61bcf2fea614b6cf9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE3E 5868 bytes
font_01_sfnt_off00011240.bin
742ae067731f95e611c268e66e8158e309ee291608e202af5d49388b51d2b8b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11240 11020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.