Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6b0efbbf1eeec99…

MALICIOUS

PDF

78.4 KB Created: 2021-03-15 02:40:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 577d4f92919d3929b31f79b24e2ece72 SHA-1: 06bef53830a11f498bfb7e13df9ec7f32484773d SHA-256: d6b0efbbf1eeec996ff7420aec03351d72349b52c8f978cac3e5924d36a7fbd2
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating it is a link farm and hosts external URIs, with one specific URI pointing to a suspicious domain. ClamAV detection as 'Pdf.Phishing.Trojan' and ML classification strongly suggest malicious intent. The document body, though heavily obfuscated, contains metadata suggesting it is a PDF generated by wkhtmltopdf, potentially masking its true malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=statistical+analysis+of+medical+data+using+sas+pdf PDF link annotation
    • https://lelopotive.weebly.com/uploads/1/3/0/7/130738546/4591099.pdfIn PDF document text
    • http://metazexepajesen.22web.org/endurance_technologies_limited_annual_report_2016.pdfIn PDF document text
    • https://fagisidide.weebly.com/uploads/1/3/2/6/132682833/8906380.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://972af30b-04c2-4618-b911-83ba0b7fef9e.filesusr.com/ugd/84a5c6_9396d5d5fc074a6198c76231f140d262.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/502ac38c-e1f0-4b68-8b93-843b8c18f8e5/demopelazixesefisuvagov.pdfIn PDF document text
    • https://s3.amazonaws.com/nolarifaforuxop/android_support_design_library_android_x.pdfIn PDF document text
    • https://d046670e-94b8-4ea2-8efc-69fca9b502c9.filesusr.com/ugd/c0b427_4a07d560e1de40e58a5533a212668015.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4035550-e55d-4406-ad8f-5072cd12c161/prentice_hall_america_history_of_our_nation_answers.pdfIn PDF document text
    • https://ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com/ugd/4530da_afe7d1d757af424d8e90304c21bbf341.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vofadoloves/equalizer_bass_booster_pro_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/imagenes_del_modelo_atomico_de_schrodinger.pdfIn PDF document text
    • http://wawefib.rf.gd/predictive_analytics_software_free.pdfIn PDF document text
    • https://s3.amazonaws.com/gazitif/maths_limits_questions_and_answers.pdfIn PDF document text
    • https://34e51215-b586-4e01-b3ea-a219475a7b91.filesusr.com/ugd/46481b_2d624a7bedfd4b93a2f98f43129821a3.pdf?index=trueIn PDF document text
    • https://57933e30-1e86-4cbe-ad2b-777cb72f9932.filesusr.com/ugd/235f1a_b8985a655f7748929b7cfc3104f22d49.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/be008a0f-e232-4e1c-bc1f-791bd65de973/lubibotokifezunukafeka.pdfIn PDF document text
    • https://s3.amazonaws.com/defujo/ohio_common_core_standards_math_8th_grade_2.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f347.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF347 5584 bytes
SHA-256: b53a62b33a756d60c966f24e22deaa8cac68d2d0eef77fbf1b3667ed429f75e3
font_01_sfnt_off0001064f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1064F 11224 bytes
SHA-256: d0324e344794e6f92311801eecdc72fdfb33692646f0ef2e8370fd6e9880c1d3

Open this report in the interactive analyzer, or submit your own file for analysis.