Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc8fa04f125b49ce…

MALICIOUS

PDF

72.1 KB Created: 2021-03-09 20:15:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: c986c3630c86d7a392a24289aacc5f01 SHA-1: 902757d6398a41f8aca8cbda950df694a873200c SHA-256: cc8fa04f125b49ce46de7bdcb8c92d61bd66c704c9d956bab8d83ceb0dd97d51
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs pointing to potentially malicious domains, identified by heuristics like PDF_SEO_DISPOSABLE_LINK_FARM and ML_NYX_PDF_MALICIOUS. The ClamAV detection further confirms its malicious nature, classifying it as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, suggests a lure related to 'Adobe illustrator full course pdf', aiming to trick users into visiting these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9921

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=adobe+illustrator+full+course+pdf PDF link annotation
    • https://cdn.sqhk.co/someteku/bV1Zigk/joserotadapirobawuxa.pdfIn PDF document text
    • http://jofifuneku.medianewsonline.com/38745670469.pdfIn PDF document text
    • https://cdn.sqhk.co/fowipovoji/bjbigtT/pressure_washer_attachments_for_hose.pdfIn PDF document text
    • http://unreguezff.rest/confused_monkey_meme_gifdans0.pdfIn PDF document text
    • http://chambreapp.xyz/which_coin_paradox_calls_for_the_ability_to_assesspbk7h.pdfIn PDF document text
    • http://sowopezamiw.medianewsonline.com/84441799725.pdfIn PDF document text
    • http://lakshmi-store.ru/fipikopebomet0jr.pdfIn PDF document text
    • http://bukupiduge.mypressonline.com/52811948466.pdfIn PDF document text
    • https://cdn.sqhk.co/gupuwiwi/igihbhb/closest_kaiser_urgent_care_near_me.pdfIn PDF document text
    • http://navevukosuso.mypressonline.com/xfinity_x1_box_not_working.pdfIn PDF document text
    • https://cdn.sqhk.co/pixefavenar/cig3ifo/womag.pdfIn PDF document text
    • http://vigorutijiwek.22web.org/how_to_pray_istikhara_for_marriage_islamqa.pdfIn PDF document text
    • https://cdn.sqhk.co/birenejar/jBx5hhQ/2d_shooter_games_unblocked.pdfIn PDF document text
    • https://cdn.sqhk.co/pumopivosoba/Hz9ggSO/movie_trivia_quiz_2000s.pdfIn PDF document text
    • https://cdn.sqhk.co/vatomepipiw/b9hfjbW/roblox_studio_login.pdfIn PDF document text
    • http://daniele.store/lysistrata_playq3doe.pdfIn PDF document text
    • https://cdn.sqhk.co/wivenute/bbhfiii/dune_2020_movie_age_rating.pdfIn PDF document text
    • https://cdn.sqhk.co/manoxixo/Ajj4Ihj/87067300208.pdfIn PDF document text
    • https://cdn.sqhk.co/nadipozow/hkibBZH/exorcist_definition_pronunciation.pdfIn PDF document text
    • http://detonic-hypertonie.website/internal_medicine_clerkship_study_guidegggxr.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/28e93042-a8a8-474a-b914-1e9fd973c5e7/netgear_wgr614v7_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d30d3842-316e-4c22-baf4-ff511bcf3331/english_grammar_test.pdfIn PDF document text
    • http://fowewimoseno.epizy.com/xolenevadovonedakosade.pdfIn PDF document text
    • http://sokekakeloji.onlinewebshop.net/47069923447.pdfIn PDF document text
    • http://sisuwexiwidal.epizy.com/pezobapeferuvepisurav.pdfIn PDF document text
    • http://fiwabafedazuv.epizy.com/69640245850.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9bc2b644-bf66-4e4e-a3ea-a298d130924b/97152297850.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1FB 5276 bytes
SHA-256: 906f3f3b55eac3b8e7eb841c43b5b53dbfd99270493f8fe9d719c697f2d594ad
font_01_sfnt_off0000f3f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3F6 9968 bytes
SHA-256: c216556d32652fc24f05da31ae7f0395259f744f60629d1c107f97bba38895b5

Open this report in the interactive analyzer, or submit your own file for analysis.