Malicious PDF — malware analysis report

Static analysis result for SHA-256 c994eec234280025…

MALICIOUS

PDF

73.7 KB Created: 2021-03-26 13:17:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: cbc050fd5b22384d6bfbff5ee705f778 SHA-1: bb3c3255216f82b7d770b51f355e7bef34a2d654 SHA-256: c994eec234280025feaf0e73a15793ac4490e8c9ec56b4e7e083672359d7ee5e
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating high maliciousness. The presence of numerous external URIs, many pointing to disposable domains or link farms, suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains strings that appear to be part of a lure, referencing a 'probability worksheet for grade 5'. No scripts were extracted, but the PDF structure and URI findings strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=probability+worksheet+for+grade+5 PDF link annotation
    • https://cdn.sqhk.co/lepemafe/c4jbidH/zufodopol.pdfIn PDF document text
    • https://putebofodabisig.weebly.com/uploads/1/3/4/3/134368176/minev-boduputotat-rasukuzobafeg-safujefitefijen.pdfIn PDF document text
    • https://cdn.sqhk.co/domuduxuro/jeigia3/flying_sword_pokemon.pdfIn PDF document text
    • https://cdn.sqhk.co/bovokolel/kibhjcK/9429328284.pdfIn PDF document text
    • https://sojutobifedurex.weebly.com/uploads/1/3/4/5/134588439/a518f7.pdfIn PDF document text
    • http://suzaxikuzexaw.66ghz.com/devotional_telugu_songs_in_doregama.pdfIn PDF document text
    • https://cdn.sqhk.co/dijogiper/higM9Oy/defender_3_hack_apk.pdfIn PDF document text
    • https://wilulesutazi.weebly.com/uploads/1/3/3/9/133997377/xaputoga.pdfIn PDF document text
    • https://nelunozulugekis.weebly.com/uploads/1/3/0/7/130739970/nibenupadafivot.pdfIn PDF document text
    • http://wepomomejunot.iblogger.org/cazadora_de_hadas_3_espaol.pdfIn PDF document text
    • https://cdn.sqhk.co/wepunajexiju/LuGigxK/madhubabu_telugu_detective_novels_free_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wanasuvedigo/panasonic_kx-tgda20_additional_digital_cordless_handset.pdfIn PDF document text
    • http://kuwitupufori.rf.gd/ditibajagovok.pdfIn PDF document text
    • https://s3.amazonaws.com/fokapikow/fojizeneneroxamowivulu.pdfIn PDF document text
    • http://jopinewo.epizy.com/how_to_drain_brewer_on_keurig.pdfIn PDF document text
    • http://verirajoxa.epizy.com/bonfiglioli_riduttori_catalogo.pdfIn PDF document text
    • http://luselobek.epizy.com/blessing_poem_worksheet.pdfIn PDF document text
    • http://wetuselosuw.rf.gd/ganpati_song_lyrics_in_marathi.pdfIn PDF document text
    • http://fexomuwitoxe.rf.gd/76163461718.pdfIn PDF document text
    • http://sesenin.rf.gd/tracktion_6_manual.pdfIn PDF document text
    • http://gilemexuwef.epizy.com/3245368757.pdfIn PDF document text
    • http://rijogutigoxek.epizy.com/chrono_trigger_snes_strategy_guide.pdfIn PDF document text
    • http://tubaduk.epizy.com/analysis_of_alcoholic_beverages.pdfIn PDF document text
    • http://marobow.epizy.com/92965608509.pdfIn PDF document text
    • http://zuwarikufaz.epizy.com/georgetown_law_externship_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e234.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE234 5692 bytes
SHA-256: ca7bf8cc45e5b824a0f654644aeec68b8632c892369edad08f3d719b94c8f23d
font_01_sfnt_off0000f5ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5AB 10544 bytes
SHA-256: aa87f211162045c270e6cc8d05ebb99ab5f769f29f1a8b6878ea3a6c08c51f76

Open this report in the interactive analyzer, or submit your own file for analysis.