Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce27d7808cf1fea1…

MALICIOUS

PDF

79.8 KB Created: 2021-04-08 06:20:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 53cead54a4804fc02a63a7cf54d189fc SHA-1: 251432b2131b42b71cfcaa72dfc0c06e03c60748 SHA-256: ce27d7808cf1fea1306571e9c2fa2bced4bbe5ec18767d8b102a8bc9cbf7dd5a
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains a large number of embedded URLs, many pointing to disposable domains, indicating a likely phishing or malware distribution scheme. The document body is heavily obfuscated and truncated, preventing a clear understanding of its specific lure, but the overall structure suggests it is designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=vaaste+video+mp4
    • http://reduslim-sito.site/speakeasy_las_vegas_mob_museum13j22.pdf
    • https://cdn-cms.f-static.net/uploads/4494875/normal_603d384d2369c.pdf
    • http://2220202.ru/en_los_zapatos_de_valeriau4c6s.pdf
    • http://kakorixow.mygamesonline.org/48627296767.pdf
    • https://kepiloxuxamife.weebly.com/uploads/1/3/0/7/130740378/keteritududavuxo.pdf
    • http://ergors.space/the_colonizers_model_of_the_world_chapter_1_summarybnrvs.pdf
    • http://fawikenaxalu.scienceontheweb.net/rival_ice_cream_maker_replacement_dasher.pdf
    • http://xtina.online/codeigniter_upload_fileheu7d.pdf
    • https://dezusopivelisuk.weebly.com/uploads/1/3/4/7/134734284/81bace344c0486.pdf
    • https://felezawobo.weebly.com/uploads/1/3/4/8/134896203/471a7dd7.pdf
    • http://xagugudel.sportsontheweb.net/27593985726.pdf
    • https://cdn-cms.f-static.net/uploads/4467577/normal_60505e544cb6f.pdf
    • https://cdn.sqhk.co/gaduwifawide/YdZiaTm/40553343593.pdf
    • http://apsdd54gfv.xyz/kipizm5eo6.pdf
    • http://kodavuviguwu.mypressonline.com/30810440992.pdf
    • https://cdn-cms.f-static.net/uploads/4449984/normal_60303420ed28c.pdf
    • https://cdn.sqhk.co/mojupesonon/held0dh/47122475099.pdf
    • https://fapovodulutob.weebly.com/uploads/1/3/4/3/134361236/29154.pdf
    • https://cdn.sqhk.co/zolaxadivowe/gw0ugfn/fivagozewiwajir.pdf
    • https://cdn.sqhk.co/wanaxowuwot/XEjaibL/lego_batman_dc_super_heroes_cheats_wii.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vagekuzoxovav.epizy.com/nixedijoxugi.pdf
    • http://dasobiviwadodaj.atwebpages.com/mini_mental_status_exam_3_questions.pdf
    • http://bafopivazizaxon.rf.gd/munomoxofexenigeritutibow.pdf
    • http://lowakeze.rf.gd/what_is_the_message_of_the_poem_invictus.pdf
    • http://tavupikegoseri.epizy.com/final_fantasy_7_remake_walkthrough_part_14.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc3c.bin
ce304d8190d556633264e3486b35f1e3d38e51d8031ddbc1b4d80bd1553cfb81		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC3C 5088 bytes
font_01_sfnt_off0000ed81.bin
28336a0cb3f8e641e75945af3d35324194abd932e21d2bc38800f63db353b10a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED81 2044 bytes
font_02_sfnt_off0000f6ec.bin
d674804a79fa6e062b3afcbeb235f3714267dddfbc9f36a8db7e7ddadcd56ca0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6EC 10448 bytes
font_03_sfnt_off00011aee.bin
8c1e3298cb301b6aa2c2aeff0a89e1cafee6626e56d5ffa98ad52a7598c40df9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11AEE 16168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.