Malicious PDF — malware analysis report

Static analysis result for SHA-256 ceb14283a5adf09d…

MALICIOUS

PDF

106.7 KB Created: 2021-03-31 15:11:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e4af26f5e3b302f6bd1f7a11ea396dc3 SHA-1: b51e293a38d801d46aec1e66dbf8059c77e67dde SHA-256: ceb14283a5adf09d1135549483e3c55796124fabf3f86dd2c2e9c55790b80435
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The document body, though heavily obfuscated, contains text related to 'nice guidelines definition of self harm', suggesting a deceptive lure. The presence of numerous external URLs, particularly 'https://maypoin.ru/123?utm_term=nice+guidelines+definition+of+self+harm', indicates the likely intent to redirect users to malicious content, possibly for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=nice+guidelines+definition+of+self+harm
    • https://static.s123-cdn-static.com/uploads/4387232/normal_5fee6e7a28bb4.pdf
    • https://static.s123-cdn-static.com/uploads/4409609/normal_60092d3e3d2c8.pdf
    • https://cdn-cms.f-static.net/uploads/4408324/normal_605333aca9a16.pdf
    • http://kemobot.22web.org/anfotericina_b_mecanismo_de_accion.pdf
    • https://static.s123-cdn-static.com/uploads/4450514/normal_5ff586acae657.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://toxiwudogosos.epizy.com/150_ml_leche_a_gramos.pdf
    • http://wowijikozo.epizy.com/structure_of_aquatic_ecosystem.pdf
    • http://zavagozurufote.rf.gd/ganapupuwozomuta.pdf
    • https://e0eed0b3-ca42-4d59-99ab-0bcda72edb80.filesusr.com/ugd/738632_5e6d02f5580f46399ac3184005572922.pdf?index=true
    • http://rapuwovire.rf.gd/cataract_operation_video.pdf
    • http://tutapivemaki.rf.gd/sample_inventory_report_format_in_excel.pdf
    • https://d1b33a7b-cde1-45d4-bc15-d4d3b6236ac5.filesusr.com/ugd/1d64af_8fd64b89a19a4ab6b9fb79562e4eb9a5.pdf?index=true
    • https://994180ce-385f-4272-9833-4a204a825e0f.filesusr.com/ugd/ec0c41_e4fb2b6d837644b7821a386077b1657a.pdf?index=true
    • http://zewixezix.epizy.com/isro_full_form_kya_hai.pdf
    • http://sarebabeb.epizy.com/nisargruna_biogas_plant.pdf
    • http://gifagedopodub.epizy.com/revista_da_natura_em.pdf
    • https://12c21f6a-324e-488c-af83-7e1076049286.filesusr.com/ugd/e84f25_b30ded321cca4afd8014057bafe1f36e.pdf?index=true
    • https://30f21d72-2b41-4965-a7bc-2abb02bf1ded.filesusr.com/ugd/47e66e_37a20b8334114a7e831b3b0fe73de3f1.pdf?index=true
    • http://xuvotawelotito.epizy.com/mortal_kombat_11_kotal_kahn_guide.pdf
    • https://5a98ae10-8c7e-48da-b83f-9bcbc644cfa3.filesusr.com/ugd/9a8764_1cb084cfb4784dda882a76b47affb54b.pdf?index=true
    • https://b615eccc-4413-4b1d-8109-ede925130a83.filesusr.com/ugd/0994f9_ac6168dd832040cc835c2b99b34ffaae.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016649.bin
c9f7c203cadf5bb7d5a8420960e074089091da6f33ceaa2fb873d7b05fb39454		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16649 5404 bytes
font_01_sfnt_off0001788c.bin
6f17ec020c318914a7728a3ca163fab5727eb0f9947b6b716c4fcdf9fcd24f0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1788C 10812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.