Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6775f53e12bb9bc…

MALICIOUS

PDF

79.3 KB Created: 2021-03-14 19:46:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: dd192c4a977f6667f20e8d449d4920c4 SHA-1: 286684e8f52023c70e745371878c59c663109ae8 SHA-256: e6775f53e12bb9bca15b8d6fe1bc94f3f2eae88d482b50dbb7cd1488e360c5a3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external URIs pointing to potentially malicious domains, suggesting it functions as a downloader or phishing lure. The PDF structure and embedded URLs are indicative of a phishing campaign aiming to redirect users to compromised or malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=tripartite+guidelines+on+fair+employment+practices+pdf PDF link annotation
    • https://cdn.sqhk.co/sewujuzanas/gC1Mjin/83128062408.pdfIn PDF document text
    • http://zokoxakabu.medianewsonline.com/bifizurofosonabegoxevaz.pdfIn PDF document text
    • http://dosaxixapaxa.medianewsonline.com/sifekogelid.pdfIn PDF document text
    • http://dirtygirl.fun/86368711182uqv8p.pdfIn PDF document text
    • http://alania365.ru/sokexamexeluparsf.pdfIn PDF document text
    • https://cdn.sqhk.co/dowotovewi/gehgdDD/47829448900.pdfIn PDF document text
    • http://cosmeteca.com/night_owl_wireless_cameras_appy76nn.pdfIn PDF document text
    • http://aycotoro0.xyz/aprender_ingles_rapido_y_facil7di2c.pdfIn PDF document text
    • http://puvepum.getenjoyment.net/68206285959.pdfIn PDF document text
    • http://fogozuvonuw.66ghz.com/elevator_saga_answers.pdfIn PDF document text
    • http://siviveko.getenjoyment.net/does_google_chrome_have_a_flash_player.pdfIn PDF document text
    • http://idealslimitalia-ufficiale.site/james_beard_american_cookery_first_edition11bac.pdfIn PDF document text
    • http://agent-spv.space/kibenum1ablx.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/boxujetanonikuv/dyson_v7_absolute_cordless_vacuum_cleaner__free_tool_kit.pdfIn PDF document text
    • http://jusarif.rf.gd/28667457589.pdfIn PDF document text
    • http://kagomovibinat.rf.gd/remesowevebenubukona.pdfIn PDF document text
    • https://s3.amazonaws.com/palikuvexake/antifungal_agents_mechanisms_of_action.pdfIn PDF document text
    • https://s3.amazonaws.com/pizivurapab/30294894796.pdfIn PDF document text
    • http://pikubub.onlinewebshop.net/what_is_the_theme_of_the_poem_the_raven.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9C8 3644 bytes
SHA-256: 1749cd9345006ed041bb019f7fcf14afdf525a9f38cc1be1b200c24375dd7d83
font_01_sfnt_off0000f6cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6CB 5524 bytes
SHA-256: 5b1d7e08688f3ef0bcd3ef899105db2022329668f0578337af2287968d74ae38
font_02_sfnt_off0001098c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1098C 10568 bytes
SHA-256: 8deec4c3900a7f3c332cc5736ed524fc0485e9ef6caeba27f9fdba3033b33372

Open this report in the interactive analyzer, or submit your own file for analysis.