Malicious PDF — malware analysis report

Static analysis result for SHA-256 d557d99080c581b7…

MALICIOUS

PDF

75.1 KB Created: 2021-03-06 07:24:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f1a0d2d5671a1c6535f17def4f96b6fa SHA-1: 2b7aed1729a7b926cb24b64e91a771f9c0fd2e9a SHA-256: d557d99080c581b7f2955dd663341b560bb602e4dcec06d584240ceeab598de6
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains numerous embedded URLs, many pointing to disposable hosting and exhibiting link farm characteristics, suggesting a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to popular Sherlock Holmes stories, aiming to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=what+were+the+four+most+popular+sherlock+holmes+stories
    • http://xifuponek.iblogger.org/kiririt.pdf
    • https://cdn.sqhk.co/wobuwozavenu/4jghpbE/fexulebatejapuzubulela.pdf
    • https://tupivoxutod.weebly.com/uploads/1/3/4/4/134467409/gipuje_moveledija.pdf
    • http://taniduvubaz.22web.org/past_simple_and_past_progressive_exercises_worksheet.pdf
    • https://vukuzimina.weebly.com/uploads/1/3/4/1/134109202/6716849.pdf
    • https://cdn.sqhk.co/fiporalisu/hjgjbI8/dream_neon_city_theme_ps4.pdf
    • https://pokasejazutiz.weebly.com/uploads/1/3/4/4/134447431/zujoxav.pdf
    • https://cdn.sqhk.co/gijesali/ij5hgaA/zedaputegujub.pdf
    • https://cdn.sqhk.co/buzodafevuj/hhijihb/guess_the_song_picture_quiz_answers.pdf
    • http://www.bestafsherlock.com/top-10-sherlock-quotes.htm
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zobawukesilebaf.epizy.com/bombsquad_mod_pack_android.pdf
    • http://dopugidov.rf.gd/how_to_lose_weight_fast_with_exercise.pdf
    • https://8eccd3b7-fb20-4588-a5b5-4d8c58591879.filesusr.com/ugd/0e6328_4539f2e28b8448fca2b4be3b5d1b72be.pdf?index=true
    • http://xipitidip.epizy.com/tipite.pdf
    • http://vibosaxijus.rf.gd/gezisafufovopafuwev.pdf
    • http://zefefudu.rf.gd/pilizesixinifibekorawire.pdf
    • https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_bbbc301f2a49444aa5dc13b3f373a25c.pdf?index=true
    • https://113c517c-d7b0-4b36-99d7-6722bcb7ef36.filesusr.com/ugd/8e66a5_6ee1c6e94a594972b2e15261a938188b.pdf?index=true
    • http://zugugizifozuwor.epizy.com/vemewupalofetezavapuxonag.pdf
    • http://pisarojimogite.epizy.com/how_to_oil_singer_sew_mate_5400.pdf
    • http://vegobojogaroju.rf.gd/dolexobawepaw.pdf
    • http://najusibajeful.rf.gd/punished_by_rewards_alfie_kohn.pdf
    • http://mimiwuzoxul.epizy.com/game_car_game_apk.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e623.bin
0cf7cddb78ea37fdc54bdf241b55824fe3e32d466e7b9805032bc36ab232f342		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE623 5424 bytes
font_01_sfnt_off0000f888.bin
7e62df344f5db98934be634c86509fe2aa30e90b3a195f4b8f668b63ae5123d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF888 11208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.