Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1535eff6536c02c…

MALICIOUS

PDF

74.8 KB Created: 2021-03-23 08:42:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a8b16fa2ce2ac6ee1d98c8920eb8459f SHA-1: 505ce7665751bf775cf52eff2b2d8d11ff4af3e0 SHA-256: e1535eff6536c02c54a9a1ca90200b7a6674b61abf6dfd3c04598bdce1220f7a
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. It contains numerous external URLs, with at least one pointing to a link farm on disposable hosting, suggesting an attempt to redirect users to malicious sites. The presence of embedded URLs and the overall structure strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=ap+computer+science+study+guide+pdf
    • https://kifezitiwiwafu.weebly.com/uploads/1/3/5/4/135400929/bowavovarenigi.pdf
    • https://cdn-cms.f-static.net/uploads/4490519/normal_60218f978a690.pdf
    • https://mojavopadagesit.weebly.com/uploads/1/3/5/3/135383036/takem.pdf
    • https://cdn.sqhk.co/sevafeluba/MTigCjb/79745827158.pdf
    • https://vomizovuzib.weebly.com/uploads/1/3/1/6/131637161/ruzit_modesujikinuvo_galidelag.pdf
    • https://cdn-cms.f-static.net/uploads/4390051/normal_602e4f2faeca6.pdf
    • https://vejamepune.weebly.com/uploads/1/3/0/7/130776484/palorewor-nasutet-pijusub-tebowilokup.pdf
    • https://cdn.sqhk.co/wenejusuzixe/aiggmFM/90512575315.pdf
    • https://cdn.sqhk.co/sofizagumup/ljhxgdE/gitavuk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/728f2513-c2b9-4bae-8100-2279a15cfbe4/33003135550.pdf
    • http://rokosarod.rf.gd/chaos_theory_introduction.pdf
    • https://uploads.strikinglycdn.com/files/efef3b9e-2fe3-4c2f-a88d-e88340e171e3/visigoji.pdf
    • http://nepogewapiw.epizy.com/ladekedamaniged.pdf
    • http://xixusavexu.rf.gd/impact_of_celebrity_endorsement_on_consumer_buying_behaviour.pdf
    • http://xidatozekef.epizy.com/piazzolla_oblivion_sheet_music_trumpet.pdf
    • http://rarifefivafew.epizy.com/tuloxafudoxepik.pdf
    • http://pivomowofafo.rf.gd/miracle_nikki_event_guide.pdf
    • http://keruxenuriwi.epizy.com/o_que_comer_para_no_engordar_muito_na_gravidez.pdf
    • https://uploads.strikinglycdn.com/files/77bee6e4-eeae-4ce2-b5df-06c5fe2858e8/29042689223.pdf
    • http://jiporeve.epizy.com/automatisme_industriel_cours.pdf
    • http://tavokitewigi.rf.gd/58097610700.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e508.bin
4e1545a1bd5b7ada8eb6fe4d5b59190a62b8dee612a7a8590dddd9408528caa0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE508 5324 bytes
font_01_sfnt_off0000f723.bin
8a6989d9f8b46c9e69ae695c047cf1d1914ea477e7c8705310917cbcd79d1d72		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF723 11124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.