Malicious PDF — malware analysis report

Static analysis result for SHA-256 e003dc75636bf5d9…

MALICIOUS

PDF

63.9 KB Created: 2021-06-03 22:13:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7b23299e1ae34ea90c0dde57785adb70 SHA-1: e032d5a16da98a793d06f4cde3887d18f93337a8 SHA-256: e003dc75636bf5d9685cbf810ce9b408e2aff5784a6baaa392d479ec7e82e08d
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one prominent URL pointing to a suspected phishing domain. The 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic indicates a pattern of using disposable hosting for link farms, further suggesting malicious intent. The ML classifier and ClamAV detection strongly support the malicious classification, identifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9487

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=how+to+withdraw+nedbank+mobile+money
    • https://cdn-cms.f-static.net/uploads/4491157/normal_6066d8fe468ed.pdf
    • https://nitogufufuwal.weebly.com/uploads/1/3/3/9/133997090/3e35051.pdf
    • https://static.s123-cdn-static.com/uploads/4451027/normal_5fe5b48e3d73f.pdf
    • https://cdn-cms.f-static.net/uploads/4414868/normal_60419f57014fe.pdf
    • https://bevarolemi.weebly.com/uploads/1/3/4/6/134685224/6447687.pdf
    • https://semezuzuxikazug.weebly.com/uploads/1/3/4/2/134234688/2140660.pdf
    • https://cdn-cms.f-static.net/uploads/4448558/normal_601d3d454c4fc.pdf
    • https://jajelawipazug.weebly.com/uploads/1/3/0/7/130739535/fipaligevujit.pdf
    • https://titapogesasoja.weebly.com/uploads/1/3/1/3/131380181/runov_ledujasugazaj_pexubixusuzi_fokiwe.pdf
    • https://cdn-cms.f-static.net/uploads/4472775/normal_600b9916e3a66.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://lekuzax.pbworks.com/w/file/fetch/144571842/grupos_de_whatsapp_de_jukilop.pdf
    • http://mulasamesi.pbworks.com/w/file/fetch/144572715/guitar_solo_scales.pdf
    • http://pokuwatosat.pbworks.com/f/can_you_aimbot_on_xbox_one_overwatch.pdf
    • http://kizisoj.pbworks.com/w/file/fetch/144510462/makkar_ielts_speaking_book_september_to_december_2019.pdf
    • http://paderukut.pbworks.com/f/how_to_adjust_accelerator_pedal_position_sensor.pdf
    • http://runaliguredu.pbworks.com/w/file/fetch/144465099/lil_peep_crybaby_el_tatuaje_que_significa.pdf
    • http://ruxafonan.pbworks.com/w/file/fetch/144509091/netflix_mission_statement_2019.pdf
    • http://sonubugu.pbworks.com/f/barrons_gre_vocab.pdf
    • http://xedidovetaw.pbworks.com/f/onn_bluetooth_headphones_user_manual.pdf
    • http://favixose.pbworks.com/w/file/fetch/144534021/82504758946.pdf
    • http://xedidovetaw.pbworks.com/w/file/fetch/144414867/solar_system_pictures_with_names_in_english.pdf
    • http://bevojoluvu.pbworks.com/f/how_to_prevent_supraventricular_tachycardia.pdf
    • http://nusuwoxub.pbworks.com/w/file/fetch/144426882/bolokubukawiroj.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9e1.bin
02a088b1ec7a51570f166d388558c1c98b1c0d285da383de3b06b5d413fd7bce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9E1 5248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.