Malicious PDF — malware analysis report

Static analysis result for SHA-256 e051fa65eed402dd…

MALICIOUS

PDF

79.9 KB Created: 2021-03-20 23:13:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc06d9dc17c0e59d704a764d3dba002b SHA-1: e3cfd6c1e79dde2fea4db3f4816baf801910f4bf SHA-256: e051fa65eed402dd74e17c12d200768011b5e4d2a77930912f72a17886607453
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous embedded URLs, many pointing to disposable hosting, suggesting a link farm or redirection scheme to deliver malicious content. The document body, though heavily obfuscated, appears to be a lure related to 'Disney Circle' setup.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/aws?utm_term=how+to+setup+disney+circle
    • https://cdn.sqhk.co/tejosepu/hjznMhg/74890069423.pdf
    • https://static.s123-cdn-static.com/uploads/4403140/normal_5fffd646c795d.pdf
    • https://cdn-cms.f-static.net/uploads/4457330/normal_5fd1bcb82e62d.pdf
    • https://cdn-cms.f-static.net/uploads/4485004/normal_604b6330252d1.pdf
    • https://cdn-cms.f-static.net/uploads/4503050/normal_60241d304e8f3.pdf
    • https://cdn-cms.f-static.net/uploads/4423166/normal_5fe9cc3a76a63.pdf
    • https://cdn.sqhk.co/riduwadanu/Hzget3z/59766304291.pdf
    • https://cdn.sqhk.co/pozuwifofub/ghbIjbZ/tagafunogopusamilim.pdf
    • https://cdn-cms.f-static.net/uploads/4451025/normal_6034c75d59b4c.pdf
    • https://static.s123-cdn-static.com/uploads/4467975/normal_5ffe27a7dd0b1.pdf
    • https://static.s123-cdn-static.com/uploads/4413980/normal_6001105605e0c.pdf
    • https://cdn-cms.f-static.net/uploads/4459166/normal_6034d52a8c47d.pdf
    • http://vakekaninu.iblogger.org/divatokujosonajo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bafemiw.epizy.com/how_to_pair_microsoft_bluetooth_mouse_3600.pdf
    • https://8a89c5bc-485b-4808-980c-66c60e8d9908.filesusr.com/ugd/834936_e00ecca0db59419e95daab69659b1819.pdf?index=true
    • http://finesegugumemo.epizy.com/bhoot_fm_20_april_2018.pdf
    • http://pomisukiso.rf.gd/metamorphic_rock_worksheet_tes.pdf
    • http://supidanerij.epizy.com/infrastructure_architecture_design_document_template.pdf
    • http://puganuditefi.rf.gd/35996296069.pdf
    • http://safefimij.epizy.com/2927879810.pdf
    • https://58552d80-c20c-4e4f-99b9-91bedbcc07a3.filesusr.com/ugd/c18496_2a819160d11341378864ecc8811c8b33.pdf?index=true
    • https://c03439ef-6557-4199-865e-586791a52b6c.filesusr.com/ugd/6bb4a2_daea7e9bd8834951a6386d956426774e.pdf?index=true
    • https://8d928d4c-4e32-4dc6-8093-d383c90b3cca.filesusr.com/ugd/b5d49c_dca96cc7906e404ca1a40e8cf5f57e18.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa8f.bin
78a41af88f6549fa4d15e916fff728432e0c4803a14e652aa5659a951ad837ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA8F 5012 bytes
font_01_sfnt_off00010bbf.bin
d96341a44e9943e16857e75bed39409f4aa37db8f4e73bcba20af3db8eedcb1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BBF 10764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.