Malicious PDF — malware analysis report

Static analysis result for SHA-256 dde796b5a7639b0e…

MALICIOUS

PDF

73.4 KB Created: 2021-03-12 18:43:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d3f3af5219ef442428ebf3ce6ee6e1a SHA-1: 19a4c4aa834a7d8d94ee23c9d0d897b319d2cfda SHA-256: dde796b5a7639b0e38d402f5ecad67232e138faf22997ef199fb73249a14285c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by multiple heuristics, including ML classifiers and ClamAV, indicating malicious intent. It contains numerous embedded URLs pointing to external domains, suggesting a phishing or malware distribution scheme. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates a link farm on disposable hosting, further supporting the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=turbo+vpn+apkmirror
    • http://kigokagutogumol.iblogger.org/biotecnologia_medica.pdf
    • https://static.s123-cdn-static.com/uploads/4453740/normal_5ff6c4dc9230f.pdf
    • http://tafagejiveduda.22web.org/35667447548.pdf
    • http://kogitijupewe.iblogger.org/dolepemoz.pdf
    • https://cdn-cms.f-static.net/uploads/4383804/normal_60119a115e35f.pdf
    • http://luziniwanemek.sportsontheweb.net/the_expanse_season_6_book.pdf
    • http://tokepubex.getenjoyment.net/59959882066.pdf
    • https://static.s123-cdn-static.com/uploads/4404520/normal_5fcf418a152e8.pdf
    • http://vumajuzatijerak.getenjoyment.net/72537842985.pdf
    • https://static.s123-cdn-static.com/uploads/4377388/normal_60071a89531f2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bevarolimesale/wufuduzituteteribusesifo.pdf
    • https://uploads.strikinglycdn.com/files/a9fdb7f5-c527-408f-8e01-c88ec69cc009/3331872932.pdf
    • https://s3.amazonaws.com/wogikokuzotaxa/aeon_flux_movie_tamil_dubbed_hd.pdf
    • https://uploads.strikinglycdn.com/files/d4c2d100-6b6b-4b36-9695-60ada3635e5f/do_dominos_employees_get_free_pizza.pdf
    • https://s3.amazonaws.com/furunumaroxun/basic_computer_application_book.pdf
    • http://pekoguwomigurup.epizy.com/entrance_counseling_answers.pdf
    • https://uploads.strikinglycdn.com/files/6ab2272b-2890-4784-9686-f9843c256f90/83226827797.pdf
    • https://uploads.strikinglycdn.com/files/fd243872-0048-475b-b48b-bc7cdd9c37c7/dixumi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e300.bin
e205c6c06a266b5b72d48ceeec65ed2bc7283942bbb7501ffe462295ab5b97a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE300 4968 bytes
font_01_sfnt_off0000f3d8.bin
a202915955a6abfa5e2edcf5366d5409660a87200d6caee0f72827c6d94c488a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3D8 11044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.