Malicious PDF — malware analysis report

Static analysis result for SHA-256 e56cb7f07468a432…

MALICIOUS

PDF

83.0 KB Created: 2021-03-26 19:44:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 73060de507229c17955b617e28f64489 SHA-1: b60bcdcfc70eb62e9b72408e2400d949d545ae68 SHA-256: e56cb7f07468a43239a4884f3ab8fae7d632f435fc1363bd534f05d92a718310
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with one prominent URL pointing to a link farm on disposable hosting, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains text related to calculator reset, which is likely a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+to+reset+your+ti-83+plus+calculator
    • http://tozaworewinox.mywebcommunity.org/67570793333.pdf
    • http://omerkatanalp.com/15127168957zok4k.pdf
    • http://takaweri.mywebcommunity.org/audio_power_amplifier_circuit_diagram.pdf
    • http://xisumagogali.getenjoyment.net/firutap.pdf
    • http://dusejetiwogodad.getenjoyment.net/acceptance_and_commitment_therapy_values.pdf
    • http://lomigakorak.getenjoyment.net/waxiduwawerarivupewa.pdf
    • http://tebeririz.scienceontheweb.net/jumper_box_near_me.pdf
    • https://cdn-cms.f-static.net/uploads/4405639/normal_6043ddf0cc760.pdf
    • https://static.s123-cdn-static.com/uploads/4470385/normal_5fe52b49e841e.pdf
    • https://cdn-cms.f-static.net/uploads/4417141/normal_604a560b47cf2.pdf
    • http://thrivewebs.com/bekodulukuzodoais2.pdf
    • http://presentinsta.online/wetutubetejefudeo150i.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/02e93655-f79a-4919-a891-82af2b3eb9c2/is_motorola_surfboard_sb6121_compatible_with_comcast.pdf
    • http://lojabupabavize.onlinewebshop.net/buwawi.pdf
    • https://s3.amazonaws.com/xufoxorog/what_happens_to_tectonic_plates_at_a_divergent_boundary.pdf
    • https://s3.amazonaws.com/zunewidimem/zoduk.pdf
    • http://benamow.myartsonline.com/fexifilidexera.pdf
    • https://uploads.strikinglycdn.com/files/34bdf33b-ef63-4b59-84d2-67ca02b76486/how_to_repair_lg_bluetooth_headset.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f971.bin
10a07fc969e6c8cf41398fcfefa625e426b29a45b33f3716d0886db1405c0d2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF971 2900 bytes
font_01_sfnt_off000103b4.bin
6b8cb03b3b5de766749f5f5da041218e0537458b328f29484b7b1a8b5eefb09b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103B4 5472 bytes
font_02_sfnt_off00011678.bin
9a92ffb65c060afc885bd41e87f812d3d6c2902a635413d0301d48da976d7e26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11678 11660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.