Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6aafed98d4b1b44…

MALICIOUS

PDF

85.9 KB Created: 2021-04-02 22:27:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: de4d442f3409e4e23e82a2da4b0b046c SHA-1: e1e99e8ccfba1676da8a4632681c0bfdc8b03d87 SHA-256: d6aafed98d4b1b440828a7e5238922d0ac43cf66c1a3b1b527a9382192a6517d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and exhibits characteristics of a link farm, with numerous external URIs pointing to disposable hosting. The embedded content, though heavily obfuscated, suggests an attempt to disguise the malicious intent by presenting a seemingly innocuous document title. The primary attack vector appears to be directing users to external URLs, likely for phishing or further malware delivery.

Machine Learning

  • Nyx PDF Classifier clean score 0.0693

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=biodata+format+for+marriage+for+boy+in+marathi+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4445889/normal_604196736baa1.pdfIn PDF document text
    • http://photoforce.ru/the_jackbox_party_pack_7obs8w.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372740/normal_6039ebe8e124c.pdfIn PDF document text
    • http://ranomurivokav.22web.org/sudelojorenujapasideron.pdfIn PDF document text
    • http://kosolibanun.iblogger.org/adobe_sign_for_outlook.pdfIn PDF document text
    • http://totalcreditcheck.info/fugupoxivzdq0.pdfIn PDF document text
    • http://usersdeviceprotectionservice.site/634686732391wb7t.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379038/normal_5ff655f12907c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4378641/normal_5ff24fa617bae.pdfIn PDF document text
    • http://fb-pageunderreview.com/durasofisoraxuduzower187c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://detekoxinusogux.epizy.com/brancardier_formation_liege.pdfIn PDF document text
    • https://329f26c8-0235-4118-8622-173d264d9cf1.filesusr.com/ugd/221f3a_7372391836634c039cc984428069c6c3.pdf?index=trueIn PDF document text
    • http://wesufonezis.epizy.com/17168603962.pdfIn PDF document text
    • https://4b4ea461-5266-411b-8735-d5290551f550.filesusr.com/ugd/7fedcf_1dedb847930c41b08f1e9c8482d14586.pdf?index=trueIn PDF document text
    • https://3bdad275-8828-414d-9063-9532e035d791.filesusr.com/ugd/c67d0c_0b839635ef194926bcd5445848c30dd7.pdf?index=trueIn PDF document text
    • https://a80c0318-1640-4d50-a016-df037fc402b9.filesusr.com/ugd/895bef_8abb656b6d1745d68a647dafaa56bdd8.pdf?index=trueIn PDF document text
    • http://zumijuxuv.epizy.com/adjetivos_en_ingles_y_espaol.pdfIn PDF document text
    • https://254a6a59-343e-4b7e-907c-c4819e171fff.filesusr.com/ugd/decf6f_c5db26dd660b4a38b20a776bd65062b2.pdf?index=trueIn PDF document text
    • https://4ab51db4-2ab9-4ce7-8cf9-a7235cd4f8a6.filesusr.com/ugd/c6359c_8a161fec2b504c5399a449fc89612322.pdf?index=trueIn PDF document text
    • http://winibivazizi.rf.gd/49336490205.pdfIn PDF document text
    • https://fc060a1e-8c1d-4b7d-bafd-75f79d4c6355.filesusr.com/ugd/c0a468_0e84d1ea0da74b398056cf0c7ece95e5.pdf?index=trueIn PDF document text
    • https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_95042d0a34094b7ca70e120d5008e86f.pdf?index=trueIn PDF document text
    • https://1eba3b37-3dce-45e8-aa15-e51a58efc0fe.filesusr.com/ugd/89e37c_96e081a7ffbf45a3929313b33a77733a.pdf?index=trueIn PDF document text
    • http://mitudosukekunif.epizy.com/zakefonagixajij.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e568.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE568 5324 bytes
SHA-256: 06e391d28c4debe15b7766e950c8ad50a8c9c2b81992654042cbdf5150e84ccc
font_01_sfnt_off0000f74d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF74D 2140 bytes
SHA-256: 289854c0292170102eeea8cd8d9fa039b7e5adf06f71653ea533c14c4e2d2c34
font_02_sfnt_off00010128.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10128 11096 bytes
SHA-256: d9ca14bca2ba2ed92ba7339a6116e29065f79460e26bb12bdd19a5063c849de7
font_03_sfnt_off00012716.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12716 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c
font_04_sfnt_off00013516.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13516 8600 bytes
SHA-256: b4e4c4b0cab1f75d7c026bc4e0731810a52e92905b1089e481de5105e5c43067

Open this report in the interactive analyzer, or submit your own file for analysis.