Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc4769d918899eff…

MALICIOUS

PDF

75.5 KB Created: 2021-05-08 01:47:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: ac63dd97d67bd2d403026c9812c21870 SHA-1: 217021e3d5e14c9aec45e9130e237b8acec7eba0 SHA-256: dc4769d918899eff1b8f1ac82faa0b4d3a7d8d9768d3feb664cc3c4f3b577fcf
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that redirect to a known malicious URL. The ML classifier and ClamAV detection strongly indicate malicious intent. The primary attack pattern observed is the use of a malicious redirector to lure the user to a harmful site, likely for phishing or to download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=army+platoon+opord+example In PDF document text
    • https://cdn-cms.f-static.net/uploads/4449192/normal_6061faf0d61c9.pdfIn PDF document text
    • http://jilavixit.medianewsonline.com/the_bastard_of_istanbul_online_free.pdfIn PDF document text
    • http://bomaduworofa.medianewsonline.com/25847592103.pdfIn PDF document text
    • http://mosebuzixat.mywebcommunity.org/synonyms_and_antonyms_complete_list.pdfIn PDF document text
    • https://cdn.sqhk.co/dutararopat/Wgdgcig/the_god_of_war_full_movie_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367631/normal_6032ac1043066.pdfIn PDF document text
    • https://cdn.sqhk.co/tumosirewuw/5ogjgdx/visit_florida_travel_guide.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd56eb59-69fa-46e6-afcc-f8fb531472b9/hp_color_laserjet_cp1215_error_printing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c179cfa-1c59-4add-b6be-e12f1faaa9dc/witcher_season_2_netflix_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3dcb3cb-2d8c-4b46-9071-2e6d369a04ba/subway_multigrain_bread_nutrition_facts.pdfIn PDF document text
    • http://napuvonir.epizy.com/rodipodo.pdfIn PDF document text
    • http://tufelorit.rf.gd/31232256028.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b96bc6fd-fea4-4e3d-9feb-84faf328f36c/boy_roald_dahl_audiobook.pdfIn PDF document text
    • http://robowogutalopet.epizy.com/actualiser_les_formules_excel_vba.pdfIn PDF document text
    • http://siparedobapu.rf.gd/39165144172.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c5a8c0e-e689-464e-8f0a-bc63113522bb/25_cognitive_biases_book.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC04 5088 bytes
SHA-256: 8b3564e240fd2253cb5fb6007146fff11f1126fb7dd2b9e60e0b7cd988840efd
font_01_sfnt_off0000fd43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD43 10572 bytes
SHA-256: 7fe3addcc672395628db8d11452f134437dd8393922d107339fec7ff87f9907f

Open this report in the interactive analyzer, or submit your own file for analysis.