Malicious PDF — malware analysis report

Static analysis result for SHA-256 dec417b95aa52e64…

MALICIOUS

PDF

76.9 KB Created: 2021-03-18 23:47:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: ee63e860a0ac98cb15cf9879f8c40454 SHA-1: c5a7595138035ea7e689f9a64613fc65447bbd95 SHA-256: dec417b95aa52e6461362940e389c1baf9d34081b222c2b214a421c0d8e5998e
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. It contains numerous external URLs, with a notable concentration on disposable hosting, suggesting a phishing or malicious redirection scheme. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the presence of external links points to a likely attempt to lure the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=crane+load+test+report+sample PDF link annotation
    • http://fofumumitem.medianewsonline.com/bujeluniwos.pdfIn PDF document text
    • https://cdn.sqhk.co/wasefago/iihFjdv/sises.pdfIn PDF document text
    • https://cdn.sqhk.co/fuzomorikat/6hhn77V/gravitrax_marble_run_uk.pdfIn PDF document text
    • http://nebemor.mywebcommunity.org/what_is_the_meaning_of_stanza_in_a_poem.pdfIn PDF document text
    • https://cdn.sqhk.co/fawabanof/0IggUv2/4711168020.pdfIn PDF document text
    • http://winokuzovew.iblogger.org/kekaha_beach_surf_report.pdfIn PDF document text
    • https://cdn.sqhk.co/nitagalut/fhaRvtD/download_league_of_legends_darkness_mod_apk.pdfIn PDF document text
    • http://fubewakixodi.22web.org/83980782959.pdfIn PDF document text
    • http://surozofawowidom.scienceontheweb.net/economia_ambiental_gilpin.pdfIn PDF document text
    • https://cdn.sqhk.co/vagizabibo/ibi4Fvc/cyber_hunter_pc_not_working.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/01d2072f-36b4-4084-b447-fc64df1e5691/44837976737.pdfIn PDF document text
    • http://sukokovevaz.atwebpages.com/59987073181.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ade00d6-b639-4cf4-b7e7-69335b22c067/gizadegiwiradekarokudi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6571676f-e3ff-4c29-99eb-c77b2de5c964/model_3_long_range_performance_update.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/99f57c9a-18da-4def-8d9d-6da3f0a8ebe4/feelings_wheel_printable.pdfIn PDF document text
    • http://mojogoralil.onlinewebshop.net/jopuruxusigagav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/efd779f9-e4ce-4b09-bbf4-6d3d6b6364be/befanepajanemixomuzil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3a24717-46fb-49e6-9ecd-e4bbd1a702f3/runamalapuwodikunujixit.pdfIn PDF document text
    • http://bugazepoja.onlinewebshop.net/can_you_void_a_contract.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ec871f9-92a5-46bb-bfbe-1749c638d4e6/how_to_make_a_dress_tighter_without_sewing_machine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6477254-5af8-45f8-876b-7a8c89effddf/50545482079.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa5e3382-e290-4754-a490-5b1761fdd655/38532782881.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f17b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF17B 5012 bytes
SHA-256: 52a46a97c2ab5a6b144ffba6cb9b08260f8aabbe4711e2a88bdd9f1a7999d1d9
font_01_sfnt_off00010266.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10266 10576 bytes
SHA-256: e33b90e72214427caa8af07120d15975634a6175acafa9180ab351553b1d7a68

Open this report in the interactive analyzer, or submit your own file for analysis.