Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6446ba9f6c982bb…

MALICIOUS

PDF

72.9 KB Created: 2021-02-24 14:35:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: b49084c4da4516e4d6d742313c9e0c9b SHA-1: 3b1b8f36df3f55625de0269cf96b2953cfb8e7f2 SHA-256: e6446ba9f6c982bb8669d25389ce79a4caf6ccb8026ae885117d9ff09afe9173
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many of which point to disposable or suspicious domains, and is flagged by heuristics as a link farm. The document body, though heavily truncated, suggests a lure related to repairing Windows 10 system files, which is a common pretext for phishing or scam operations. The presence of external URIs and the overall structure strongly indicate an attempt to redirect users to malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=how+to+repair+windows+10+corrupted+system+files PDF link annotation
    • http://plsale.pro/how_to_fix_lg_v20_screen_retentionb4kb5.pdfIn PDF document text
    • http://fherixq.com/free_download_rap_mp3_ringtones_malayalamjcqus.pdfIn PDF document text
    • http://autokenn.com/are_delonghi_oil_heaters_expensive_to_rundy5ps.pdfIn PDF document text
    • http://witotikumuw.22web.org/xudukeweruvavuberajo.pdfIn PDF document text
    • http://snail-case.store/data_science_bootcamp_for_beginnersr387r.pdfIn PDF document text
    • http://helplnstagramcontact6088757.com/lord_of_the_rings_return_of_the_king_pc_downloadgqs70.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412158/normal_60066632192bf.pdfIn PDF document text
    • http://fogugevup.22web.org/restricted_stock_options_tax_reporting.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4496577/normal_5fcb2ca8529b7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459320/normal_5fe44e5a8a925.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486344/normal_5fe6511dccb76.pdfIn PDF document text
    • https://cdn.sqhk.co/jilowepe/CXwSggU/65159114066.pdfIn PDF document text
    • http://beamorem.com/xufegixukovomamovate98a0b.pdfIn PDF document text
    • http://otomail.business/bhp_billiton_limited_annual_report_2018li0ul.pdfIn PDF document text
    • https://cdn.sqhk.co/favejofu/fjgi8ji/mupiwipa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371025/normal_601637d5b9bde.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kisuneronebel.rf.gd/nexeditegefelimibiwegof.pdfIn PDF document text
    • http://poposumezaxek.rf.gd/37149564209.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e057.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE057 5648 bytes
SHA-256: 480cb989f10ddc421f6546013ecad5e288238b5f0db37e6369ea0f125e03fb08
font_01_sfnt_off0000f395.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF395 10080 bytes
SHA-256: 5e06f9048680fb64e1b7716376fd56e6135ce0a67f2c3f0690e48ff6ac6e0807

Open this report in the interactive analyzer, or submit your own file for analysis.