Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5e2c9a4ffa2b375…

MALICIOUS

PDF

74.8 KB Created: 2021-03-29 11:26:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8ea6977c566b9689e7061556d9397991 SHA-1: 13a8e5c03499fc367d8af9c8a52d78925255b08d SHA-256: e5e2c9a4ffa2b375be5774cf972e9e56378e8ab976490c03de49f700c5d799a9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. The document body, though partially corrupted, suggests a lure related to 'Logo quiz minimalist level 8 answers'. Numerous external URLs are embedded, many pointing to disposable domains, indicating a likely redirection to a malicious site for further exploitation. The presence of PDF-specific heuristics like 'PDF_SEO_DISPOSABLE_LINK_FARM' reinforces the malicious intent of using the document to distribute links to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=logo+quiz+minimalist+level+8+answers
    • http://xuzerujagojagip.scienceontheweb.net/air_force_academy_map_colorado_springs.pdf
    • http://roxifij.22web.org/sanoterejula.pdf
    • http://frasqen.online/nirinorirukc23mb.pdf
    • http://nebatomefov.scienceontheweb.net/how_sinkholes_form_in_florida.pdf
    • https://cdn.sqhk.co/togixulala/jiUoghg/nufetelavujuwo.pdf
    • http://bcipreactivaperu.com/wewizefoxodb4ji2.pdf
    • http://parralax.net/virginia_house_of_burgesses_worksheet_answersxqd1x.pdf
    • http://jovepodixowofow.mygamesonline.org/39393080951.pdf
    • https://cdn-cms.f-static.net/uploads/4369164/normal_60558342bfbfd.pdf
    • http://lishop.site/68678643185s8yd0.pdf
    • https://static.s123-cdn-static.com/uploads/4367273/normal_5ff1092255897.pdf
    • http://fallofelin.online/sejogapikgwgzi.pdf
    • https://static.s123-cdn-static.com/uploads/4451049/normal_5fec28c649c38.pdf
    • http://shopsmmv.site/carrier_services_near_me6e7rw.pdf
    • https://cdn.sqhk.co/daxerarugak/iLwcrhc/powigeremimonopubuvi.pdf
    • http://tipografiyav.moscow/delta_luv_crib_model_4750-1_instructionsay27c.pdf
    • https://static.s123-cdn-static.com/uploads/4368781/normal_5fc988f764d0c.pdf
    • http://dobogoj.iblogger.org/53257853528.pdf
    • http://espaceclient-cmb.com/gadanigunalofoziwq36uu.pdf
    • https://cdn.sqhk.co/palubavuz/jajgwdT/jufavazoriwaxufezowonif.pdf
    • http://aduo5.online/going_get_tough_movielfsv5.pdf
    • http://tersq.space/excel_formulas_in_hindixokct.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://garulolit.rf.gd/xamarin_forms_binding_property_not_found.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e404.bin
a6262b621939b5b0854266f7eb2f3ebeb99593f1f7531e48b481e1a121090a74		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE404 5468 bytes
font_01_sfnt_off0000f6a9.bin
8a240539f02df240fa479efb8a16ff01027463ef3306a6deb2ad4543cd52a1c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6A9 11408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.