Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4ee56c4ad4fd7d3…

MALICIOUS

PDF

92.2 KB Created: 2021-02-28 15:35:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 010d6dc05635930982b9d39007bf4028 SHA-1: 1ff75b11c3c2e94c1987901a49c9719db13f0985 SHA-256: e4ee56c4ad4fd7d37c8d9d3b8ea11128c421d755cb74ebf1ae5bf00077066a76
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic indicating a large number of external links, with one pointing to a potentially malicious domain ('nawopezor.rf.gd'). The document body, though heavily obfuscated, suggests a lure related to appliance repair. The presence of external URIs and the ML classifier's high confidence score indicate malicious intent, likely to redirect users to a malicious site for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=how+to+repair+timer+of+washing+machine PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4475987/normal_602f3ae45e058.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366655/normal_5febef1b57651.pdfIn PDF document text
    • https://cdn.sqhk.co/vajirasavuz/jbkid2P/kahoot_play_create_quizzes_descargar.pdfIn PDF document text
    • https://cdn.sqhk.co/mevazasid/hghbzqn/bumiti.pdfIn PDF document text
    • https://bisigategisabuv.weebly.com/uploads/1/3/4/8/134884720/siretanalolubijufibu.pdfIn PDF document text
    • https://wujawosekeg.weebly.com/uploads/1/3/4/7/134712458/2744866.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470029/normal_60240fa4da4c0.pdfIn PDF document text
    • https://cdn.sqhk.co/gonolesuzam/dji5jds/runagokojaz.pdfIn PDF document text
    • https://cdn.sqhk.co/tokarikadez/LiaMRgh/microsoft_teams_macbook_pro_camera_not_working.pdfIn PDF document text
    • https://xovixonu.weebly.com/uploads/1/3/4/8/134896571/2676499.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nawopezor.rf.gd/wutofifokaboj.pdfIn PDF document text
    • https://s3.amazonaws.com/rivazixexuguri/convertir_de_a_word_smallpdf.pdfIn PDF document text
    • https://s3.amazonaws.com/xufujofaleki/verizon_fios_volume_remote_not_working.pdfIn PDF document text
    • https://s3.amazonaws.com/lemerisinivum/fisheye_lens_camera_android_app.pdfIn PDF document text
    • https://s3.amazonaws.com/jodabiladezot/compress_illustrator_cs6.pdfIn PDF document text
    • http://tadigolunus.rf.gd/twilight_2012_full_movie_download_in_hindi_filmyzilla.pdfIn PDF document text
    • https://s3.amazonaws.com/xotomisen/what_is_the_greek_root_word_for_write.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0001404f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1404F 20552 bytes
SHA-256: 9c4697a5ea8829e8f29383a4e15f96123181134cd82e870a4d94a0a16843ab41
font_00_sfnt_off00010a3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A3F 5452 bytes
SHA-256: 67c2754bd4ada3e5e43be07dbe71c243185703ff2ab558762c199a30f4a4b871
font_01_sfnt_off00011cb6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CB6 10324 bytes
SHA-256: f497f66dd82dfcff33523e05fe7b7c9e8fdc3e20ec99aa6d7c05a46becb899ae

Open this report in the interactive analyzer, or submit your own file for analysis.