Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc0978495b878754…

MALICIOUS

PDF

93.2 KB Created: 2021-05-09 03:28:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 0f6a4cb2a4bdf0ae0d8b0e0f77a2a42f SHA-1: 983d3c52a247a2f4c5a62e153f67951001cb1c00 SHA-256: cc0978495b8787543ed8555423c3426a3bfba90d2ca171db717b0c23458b461b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one specifically identified as an external URI pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a search result or similar lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=is+there+part+2+of+fifty+shades+of+grey PDF link annotation
    • https://cdn.sqhk.co/nivavepe/HgjKihN/mokiluvabedogud.pdfIn PDF document text
    • http://badgesverified.com/5833204865e88dn.pdfIn PDF document text
    • http://hr-insider.com/loripiriribopikakezutormlsws.pdfIn PDF document text
    • http://suberubepuparo.getenjoyment.net/xoxapupoxito.pdfIn PDF document text
    • http://wegoradubi.sportsontheweb.net/fifilugemimuwi.pdfIn PDF document text
    • https://cdn.sqhk.co/raserijene/BVicieR/outdoor_tabletop_electric_fireplace.pdfIn PDF document text
    • https://cdn.sqhk.co/ralapogifur/M2MfYge/dj_sounds_effects_horn.pdfIn PDF document text
    • http://securityverifiedservices.com/206482067922s6c0.pdfIn PDF document text
    • https://cdn.sqhk.co/fopeziriga/gjiwgib/reincarcare_cartela_wind_online.pdfIn PDF document text
    • http://tibudirowe.mygamesonline.org/zekotogekukuradeg.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://6f81cef9-66a2-447d-9e1d-4c0427ef15c5.filesusr.com/ugd/4d935e_d960fc9f73ce4277b0add7e007053094.pdf?index=trueIn PDF document text
    • https://6200e599-3f2f-4e3e-ab45-e6977ed7e777.filesusr.com/ugd/f8de3e_d2865718102e49d99b07ac6d19b51648.pdf?index=trueIn PDF document text
    • http://doxokalisawe.myartsonline.com/setelixi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0104d5b6-3317-4dfe-a317-7f8b3f3b6989/ge_ultrapro_universal_remote_codes_for_vizio_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1b445eb-78cd-4486-8232-671ea1b0f23d/oster_professional_a5_turbo_2-speed_equine_clipper_kit.pdfIn PDF document text
    • http://bizotuku.epizy.com/lodebadet.pdfIn PDF document text
    • https://f18b8dc1-3ce9-44bd-8712-01435d039869.filesusr.com/ugd/b97cba_a7703d8060b3497dbd1e0b1e2a5808a4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e65acd7d-3774-4d21-9085-989c66b25acb/mekevopenosexife.pdfIn PDF document text
    • http://movuzog.rf.gd/waluzit.pdfIn PDF document text
    • http://jizabimumonox.rf.gd/reported_speech_positive_sentences_exercises.pdfIn PDF document text
    • https://3796e7af-74f6-4269-b4b1-c98d6d9a2df3.filesusr.com/ugd/169b5e_d6cff28810594289b54446b52df95cec.pdf?index=trueIn PDF document text
    • http://kalilom.epizy.com/notevonefisadikuvi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011c4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C4D 5124 bytes
SHA-256: af0089cc118c5fd1e06e49fc6b5c6fa6add96ee5b48748165ea7cec4222c00e2
font_01_sfnt_off00012dd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DD3 13088 bytes
SHA-256: 7f1bdff5029492129025579a83f2a44ba56e179e36cdc37d469fbf320af76d14
font_02_sfnt_off00015935.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15935 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378