Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7224afc98d4f0db…

MALICIOUS

PDF

79.8 KB Created: 2021-03-16 00:02:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: b7be43be7a02d1051bb17ceb6c71e104 SHA-1: ab252a8032cd787381b669894a382d2b5990373c SHA-256: e7224afc98d4f0db08b449bfa285d2b426d6602dacd13c3fa32da7ef7f3ecd4f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified as a phishing attempt by ClamAV and ML classifiers. The heuristic PDF_SEO_DISPOSABLE_LINK_FARM further indicates a link farm hosted on disposable infrastructure, suggesting a malicious intent to redirect users. No scripts were extracted, but the overall structure and embedded URL strongly suggest a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=6.0+powerstroke+service+kit PDF link annotation
    • https://cdn.sqhk.co/robimovule/zxxeicH/48925481026.pdfIn PDF document text
    • http://cocobeautybar.ca/ias_23_questions_and_answerssljak.pdfIn PDF document text
    • https://cdn.sqhk.co/pabilere/heVboif/nonogram_color_picture_cross.pdfIn PDF document text
    • https://cdn.sqhk.co/mopewedote/whdb4ic/swot_analysis_weakness_vs._opportunities.pdfIn PDF document text
    • https://cdn.sqhk.co/rebabafa/Sp2ihet/masisukakotuvipo.pdfIn PDF document text
    • http://rijepesejib.22web.org/black_ted_dekker_sparknotes.pdfIn PDF document text
    • http://telgrm.site/kivuvuwagasuba0ud34.pdfIn PDF document text
    • http://geleostone.online/jijesin8gcif.pdfIn PDF document text
    • https://cdn.sqhk.co/bexefoboxevi/GrjiV7S/om_nom_run_no_ads.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f282872f-73bf-4e2d-a298-c01f168ebbed/autocad_plant_3d_ortho_view.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0333496-ab97-4a91-8209-440b4b83483f/work_stress_scale.pdfIn PDF document text
    • https://s3.amazonaws.com/nemafu/midovonesavivavimo.pdfIn PDF document text
    • https://45f61934-b4a1-4335-a9e3-e142d9465b5b.filesusr.com/ugd/0dd040_1bc90a6d05284c35a8f18aabcc0cfed7.pdf?index=trueIn PDF document text
    • http://xibiwoziveva.epizy.com/jotupo.pdfIn PDF document text
    • https://357b8bef-7330-4cfe-b31d-389db25c4d5a.filesusr.com/ugd/4c76bf_3a32dca14a304ebbbd10899cb17c6a67.pdf?index=trueIn PDF document text
    • https://61069a5e-3c5f-4884-a3c7-8c7552058b74.filesusr.com/ugd/0789d5_decab47850904620b2e040bb18254d2c.pdf?index=trueIn PDF document text
    • https://fb4bdcd3-28a3-4206-a6c3-fb267f511c23.filesusr.com/ugd/0ad562_fb0503f2281e43a49604eb14460f5ca3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/viwoxuz/what_boots_can_you_wear_in_the_navy.pdfIn PDF document text
    • https://945b3f91-9c76-4178-be32-f0dab3cfe2c6.filesusr.com/ugd/8d5d69_3d85eede5e1347b68b4227a3f1151cc2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gezetega/lalofujajofevosowuxev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0bb252c-909c-4d78-b885-7486774e25d2/rogutalixoduzawilojok.pdfIn PDF document text
    • http://muvipifipu.rf.gd/55789151674.pdfIn PDF document text
    • https://s3.amazonaws.com/zolerazowubow/vufazuxaluji.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB61 5132 bytes
SHA-256: 74cb0ac9296b4c5caf71500f448fc8449c98e2815110f0e7796ec0630f823dee
font_01_sfnt_off00010d10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D10 10688 bytes
SHA-256: dee12e6e9caf30f8102566bb646fbfed88acb70101d1d751de1765e9591cb0c8

Open this report in the interactive analyzer, or submit your own file for analysis.