Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2e8b03fb41b3985…

MALICIOUS

PDF

290.3 KB Created: 2021-03-24 06:26:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 6796dfcf940b6255c88e9543646e4d50 SHA-1: 341714a5eccbf5c7ac4cfec21ea0243d824e308c SHA-256: d2e8b03fb41b398596cacd068e178f3b2c4b374567221749db89f59525319962
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI and an SEO redirector link suggests a phishing or malware distribution attempt, likely using a lure to entice users to click. No scripts were extracted, but the PDF structure itself contains links that could lead to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9825

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=legally+blonde+jr+soundtrack+lyrics PDF link annotation
    • http://pufuwobexoz.iblogger.org/journal_bearing_design_procedure.pdfIn PDF document text
    • https://goponubinolofuv.weebly.com/uploads/1/3/4/6/134695307/5690509.pdfIn PDF document text
    • http://tuvetetin.22web.org/fafosa.pdfIn PDF document text
    • https://pazijovipa.weebly.com/uploads/1/3/4/3/134327002/0601290ce.pdfIn PDF document text
    • http://kemobot.22web.org/ropojasuxed.pdfIn PDF document text
    • http://butalinonoruma.scienceontheweb.net/vebudevirobunezuzuwosuwas.pdfIn PDF document text
    • https://pojirada.weebly.com/uploads/1/3/2/7/132741169/5016429.pdfIn PDF document text
    • https://fatatovol.weebly.com/uploads/1/3/4/7/134707957/aeb6ec2494.pdfIn PDF document text
    • https://mebedepubini.weebly.com/uploads/1/3/0/8/130813558/7980868.pdfIn PDF document text
    • http://xunajoza.22web.org/31077904466.pdfIn PDF document text
    • http://nibewubixela.getenjoyment.net/47304295145.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://22e365c6-0853-42e1-82f8-83473bf9c0bf.filesusr.com/ugd/217d68_d3554304613241b4bd481df805536122.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jaxesabi/amman_tamil_dubbed_movie_songs_free.pdfIn PDF document text
    • https://s3.amazonaws.com/fobupojowojon/lukezo.pdfIn PDF document text
    • https://s3.amazonaws.com/piradi/tubewesojetekekago.pdfIn PDF document text
    • http://rafokusavuti.epizy.com/treasurer_s_report_template.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxexi/best_free_admin_template_2019.pdfIn PDF document text
    • https://0dea665b-aaaa-42f3-a52c-f86f0fd1efa2.filesusr.com/ugd/8b9728_c9913b80e38d40509c7cd013ea9f6b69.pdf?index=trueIn PDF document text
    • http://dazozelagur.epizy.com/76386489770.pdfIn PDF document text
    • https://68f06c25-eb64-4e0a-94e3-a0e33e610147.filesusr.com/ugd/463ace_a11503390bcf4747aac7acfd4125ca58.pdf?index=trueIn PDF document text
    • https://3c3713de-992c-4571-92b4-00afcb8cb2c1.filesusr.com/ugd/9dbdb2_f9375a5166e14de4bf988c4dec43d593.pdf?index=trueIn PDF document text
    • http://pudolajuji.atwebpages.com/principles_of_auditing_and_other_assurance_services.pdfIn PDF document text
    • https://f1801c53-b3f5-4b94-a9b3-4bb8eb376a66.filesusr.com/ugd/af633f_91b850b8902f43a5bd338856691c8e04.pdf?index=trueIn PDF document text
    • http://vavadot.onlinewebshop.net/fexowamuza.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00043818.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x43818 5428 bytes
SHA-256: fa0baff33252fa07c1534217c4ef95379621aab085e862ccf6b12c7ff942418c
font_01_sfnt_off00044aae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44AAE 14408 bytes
SHA-256: 426739af4f8ac44cc3ee53f22b620eaa5ac9c3b315fe72daeb0e57409ff3b71e

Open this report in the interactive analyzer, or submit your own file for analysis.