Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1ccd539dfa0aa72…

MALICIOUS

PDF

77.3 KB Created: 2021-06-11 13:54:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: e80290fd5eaa0bb598f2305c1285a624 SHA-1: 6a78242079421fcbfb859ebd42ee64e431eddebc SHA-256: d1ccd539dfa0aa723f4423f2972789d4bfc2325de3570566420cfa7b12dcb874
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier indicating maliciousness. The presence of embedded URLs, specifically 'https://garglob.ru/pbw?utm_term=cswp+segment+1+pdf', suggests an attempt to redirect the user to a potentially malicious site. The document body, though heavily obfuscated, contains references to 'cswp segment 1 pdf' and the authoring application 'wkhtmltopdf', indicating it's likely a lure document. No scripts were extracted, but the overall structure and URL suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/pbw?utm_term=cswp+segment+1+pdf PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://najapenoz.pbworks.com/f/vabidugadug.pdfIn PDF document text
    • http://sagidetubi.pbworks.com/f/23818154250.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7dfcee8-fa02-4f2b-86b9-be96be40d2ba/droite_demi_droite_segment_6eme.pdfIn PDF document text
    • http://popuwepux.pbworks.com/f/sylvia_plath_ariel_critical_analysis.pdfIn PDF document text
    • http://tejudafo.pbworks.com/f/turbo_dismount_mod_apk_2020.pdfIn PDF document text
    • http://vedufid.pbworks.com/f/jinoruwufe.pdfIn PDF document text
    • http://pitavumiza.pbworks.com/w/file/fetch/144680304/brahma_murari_surarchita_lingam_telugu_mp3_song_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c25600c7-4847-41d0-a8fc-324530cce365/27412525305.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2bc3a09-8ccc-4adb-9073-e18eb5f83cb1/simulacra_and_simulation_audiobook.pdfIn PDF document text
    • http://lakiluxodev.pbworks.com/f/defepofolatet.pdfIn PDF document text
    • http://fuxedemama.pbworks.com/f/earn_to_die_3_mod_apk_free_shopping.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/548118a1-985a-4cb2-b0af-86f6c57f14f5/gujizadilexala.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/314eef72-cd08-4cb6-a5e6-3b0cd5837144/words_to_describe_rainsford_in_the_most_dangerous_game.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7a7d767-f08c-4690-b36f-f7f7f73cb289/their_eyes_were_watching_god_audiobook_chapter_13.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf32c76d-f04f-4888-aed2-cfc280c26650/48546917459.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59f57983-611a-4dcd-8b41-1e65b32f509b/63961416645.pdfIn PDF document text
    • http://savavaze.pbworks.com/f/the_hunger_games_catching_fire_full_movie_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbe08cad-2a09-474b-9811-c335494dd33b/45402983940.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69afb720-11a6-40e8-aa7a-169d5515aa6e/79405012483.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95ed31c3-6942-42d6-8a7d-9d00020bdfc3/ridgid_wet_dry_vac_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0308f9c-ba22-415b-aa8c-28142e3ea4ba/73518387208.pdfIn PDF document text
    • http://motewutoma.pbworks.com/f/adding_and_subtracting_integers_word_problems_worksheet_with_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f04343b-f03c-4596-bedd-1e8dde26c9e3/dominos_pizza_allergy_list.pdfIn PDF document text
    • http://sovafiben.pbworks.com/f/types_of_conditional_sentences_in_english_grammar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1DF 4820 bytes
SHA-256: 4585bc570d220df3cf99429268da68005f25bf0a5e2653b97a05e25ae927c149
font_01_sfnt_off0000f250.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF250 11644 bytes
SHA-256: f3ddc4b2d6ab34fe14b257a1bc33abd6a96db1c16ff9c1f4996cd8ccfdaf90b0
font_02_sfnt_off000119f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119F4 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.