Malicious PDF — malware analysis report

Static analysis result for SHA-256 db9541b7bb3b82c1…

MALICIOUS

PDF

77.2 KB Created: 2021-03-20 05:26:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 9481bd0819826fa4c730b8b92fd25b19 SHA-1: cd837dee16449276e061e101308334761d717ac5 SHA-256: db9541b7bb3b82c17802af203324f88444f906c60d7efcf8075b7450e540df1b
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier indicating maliciousness. It contains numerous external URIs, with one specifically identified as a link farm on disposable hosting, suggesting a phishing or malware distribution attempt. The presence of embedded URLs and the 'Urgency / deadline lure' heuristic further support this conclusion.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=wondershare+tunesgo+free++for+mac PDF link annotation
    • http://zegererevez.medianewsonline.com/how_to_remove_battery_from_motorola_flip_phone.pdfIn PDF document text
    • http://rowowevu.mypressonline.com/winter_table_ideas.pdfIn PDF document text
    • http://gikizevububem.22web.org/roomba_980_battery_dies_before_docking.pdfIn PDF document text
    • http://vatemuredaxusob.22web.org/salesforce_edit_report_permissions.pdfIn PDF document text
    • http://sifimomikev.sportsontheweb.net/visusasur.pdfIn PDF document text
    • http://xazonojader.mywebcommunity.org/asvab_afqt_practice_test.pdfIn PDF document text
    • http://sewamagiz.66ghz.com/heart_barracuda_320_kbps.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://9a89a7da-ede3-42eb-a537-7416be21eb2d.filesusr.com/ugd/aaaf79_75c33d7609384b288ae310332bbb9b26.pdf?index=trueIn PDF document text
    • https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_6a63756c64464b7a9db3ad4c4601fbd6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/putelekireza/puluga.pdfIn PDF document text
    • http://vixofisan.rf.gd/rujonixajesuza.pdfIn PDF document text
    • https://s3.amazonaws.com/tuzakifezara/bahubali_2_film_tamilrockers.pdfIn PDF document text
    • http://zexeborora.rf.gd/saboteur_spelregels.pdfIn PDF document text
    • http://gisobugiwe.rf.gd/connection_game_images_with_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3a84e67-ad06-48b8-9fd6-e3dc768ef290/singapore_math_live_primary_4.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a633a0b2-71ae-4352-97b5-bb8eec2b833b/kindergarten_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/kegubinefuda/swayamvaram_gali_vanalo_song.pdfIn PDF document text
    • https://4bf641bf-117a-4913-931f-55e49063997f.filesusr.com/ugd/5befcb_f79bc5e637c44189acb3362b3c842ba2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/minaxigevani/67229371948.pdfIn PDF document text
    • http://kixixiwibatogit.epizy.com/abdomen_agudo_hemorragico.pdfIn PDF document text
    • https://s3.amazonaws.com/wegemebufojafak/68708661516.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89f6fe60-24cb-40d1-84eb-300a99e29642/what_kind_of_transmission_fluid_for_turbo_350.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f098.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF098 5416 bytes
SHA-256: 8781d7cce39796c0d0a0376a6b574536f46ba9de9d5bcc6f013f5ad3296d9783
font_01_sfnt_off000102ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102EC 10440 bytes
SHA-256: cb0bf02d5fe2765ca54dc6cc1fb4f299cb41eed1dcf7a3c43d02376b8ec85a23

Open this report in the interactive analyzer, or submit your own file for analysis.