Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5ceba2f2f1ea34a…

MALICIOUS

PDF

80.4 KB Created: 2021-04-02 23:40:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 81489cf1481492d84d4179cb92fb60f8 SHA-1: 8bffdb5682318514f38f2f7f9840e90a578b9456 SHA-256: d5ceba2f2f1ea34a000c5b3124ae6ef32dcd7541191ff7db7d10dc31b3f81dcc
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs that lead to potentially malicious domains, disguised with keywords like 'cbse class 10 sample paper'. Heuristics indicate it's a link farm on disposable hosting, and ML classifiers and ClamAV strongly flag it as malicious, likely a phishing or trojan delivery mechanism. Although no scripts were explicitly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9755

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=cbse+class+10+sample+paper+2020+english+pdf
    • https://static.s123-cdn-static.com/uploads/4425926/normal_5fc9f71a977d8.pdf
    • http://xifufexiruma.iblogger.org/the_bronze_horseman_trilogy_reviews.pdf
    • https://cdn.sqhk.co/lazimafuxuxi/fIhizhe/bigbang_kpop_quiz.pdf
    • https://cdn.sqhk.co/zereseful/7bdjchc/79507818379.pdf
    • http://bosemefawixuwov.mypressonline.com/59434633239.pdf
    • https://cdn-cms.f-static.net/uploads/4482848/normal_606209dfd6242.pdf
    • https://static.s123-cdn-static.com/uploads/4413005/normal_5fe124c3f232a.pdf
    • https://static.s123-cdn-static.com/uploads/4499629/normal_5fec43930dc89.pdf
    • http://bipiraxas.iblogger.org/84649079848.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tijiwef.epizy.com/realidades_1_capitulo_2b-_8_crossword_answers.pdf
    • https://s3.amazonaws.com/wajibile/what_is_a_caramel_swirl_iced_coffee_at_dunkin_donuts.pdf
    • http://malejubu.myartsonline.com/39867431197.pdf
    • http://nuvitaros.epizy.com/dc_district_3_police_station.pdf
    • http://nukivamo.myartsonline.com/27189169357.pdf
    • http://sisubupofi.epizy.com/46465471979.pdf
    • https://s3.amazonaws.com/lowuwofuxali/honeywell_th8321r1001_installation_manual.pdf
    • http://bakilipos.epizy.com/63623859127.pdf
    • http://dasanurarad.epizy.com/magun.pdf
    • https://s3.amazonaws.com/jolituzoji/carcinogenesis_mutagenesis_case_reports_cmcr.pdf
    • https://s3.amazonaws.com/zunaduxa/jeziloziwigif.pdf
    • https://s3.amazonaws.com/pogolo/speaking_english_conversation_free.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001039f.bin
be8c706c335d39cc77ebd87d2ba46613d7457b237dc15ccf291e9124612a8a53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1039F 5940 bytes
font_01_sfnt_off000117a1.bin
09d5f57d9b6b00dfb5253552e3263af38ab73751a4d6fd261bde4c448c0c06e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x117A1 11236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.