Malicious PDF — malware analysis report

Static analysis result for SHA-256 d165afca25059204…

MALICIOUS

PDF

77.1 KB Created: 2021-05-21 02:21:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: b9201129f546c826b1c8f0e5b2fe7862 SHA-1: 91f2703d61ac6dc73fff6c77b6d6d8f7453b00ca SHA-256: d165afca25059204f7076322cbbdb7797c53e73111763b447812951419b82c46
264 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains numerous links to external websites, with one specifically identified as a malicious redirector. The presence of a 'callback lure' heuristic suggests a phishing or scam attempt. The ML classifier and ClamAV detection strongly indicate malicious intent, likely involving the exploitation of PDF vulnerabilities to redirect the user to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=how+to+run+a+bissell+proheat+pet In PDF document text
    • https://cdn-cms.f-static.net/uploads/4371536/normal_604ec267658e8.pdfIn PDF document text
    • https://nazigexasuv.weebly.com/uploads/1/3/6/0/136081917/2995860.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4496204/normal_5feefa9ec64d4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393348/normal_5fdd9eee26a8f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366339/normal_604180ecb62dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410211/normal_606913c07d139.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371261/normal_5fee183259512.pdfIn PDF document text
    • https://nivojekegup.weebly.com/uploads/1/3/5/3/135322075/2150951.pdfIn PDF document text
    • https://wabezapodila.weebly.com/uploads/1/3/1/4/131437306/7717579.pdfIn PDF document text
    • https://moxigowa.weebly.com/uploads/1/3/0/8/130814106/3401299.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456114/normal_5fd68b35f2961.pdfIn PDF document text
    • https://lisofagan.weebly.com/uploads/1/3/4/5/134598873/zolon_bixatiwelifa_zaxepesijomuw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485822/normal_6036c4361c726.pdfIn PDF document text
    • https://vuguzazevuzuk.weebly.com/uploads/1/3/5/3/135316601/5149118.pdfIn PDF document text
    • https://zapokeboxopi.weebly.com/uploads/1/3/0/7/130776852/aedd87fecbd.pdfIn PDF document text
    • https://fudukonuxevefez.weebly.com/uploads/1/3/4/6/134606022/vidobubarip.pdfIn PDF document text
    • https://sakafafemowuva.weebly.com/uploads/1/3/4/6/134694971/c1f0b6a47.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488570/normal_5fc8566804b9e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a5e9d01-010d-446b-afb4-77f9363ca1b7/bakakaki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a1d8f96-3c46-495b-816e-b155f9939f33/sevunulijutobuwasoxek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc8d18d9-1706-4851-940f-98453dca323e/how_to_sue_a_school_for_discrimination.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc59937a-2576-4efc-bbab-a9f0f2cb70a4/tifanepibajowoxevojigelex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a1efb97-4ca2-4aba-b26e-2d8ac04200ce/spider_man_animated_series_1994_full_episodes_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd6a3990-999e-491c-896d-fb0ba0e1e4f8/kenmore_coldspot_refrigerator_size.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06242633-5535-4274-b86c-1d18a174eee2/how_much_do_facebook_portal_cost.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69f39247-e5fa-4683-a429-72d060b2d5a5/what_age_is_percy_jackson_books_for.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/04639c82-98ab-4a12-a73a-2101094a3ecb/solucionario_qumica_analtica_cuantitativa_day_underwood.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFDD 5100 bytes
SHA-256: 84162c6e1befaa544849eea5e3130d357bd35ed1aaacad38170a9f1c7f485d56
font_01_sfnt_off00010136.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10136 10984 bytes
SHA-256: 097b286a73b04bda1ef0fb125120a6a9f1425343a64a8de2d02931b42e634668

Open this report in the interactive analyzer, or submit your own file for analysis.