Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7ad8f93d6a4989c…

MALICIOUS

PDF

84.0 KB Created: 2021-03-27 12:29:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: c9827830be4101f16c10abe74308200c SHA-1: f3ab05b2ab3e469fef981e56e85108ccefbdf1c4 SHA-256: e7ad8f93d6a4989cb2155e2507aa202e23c33c89c1c4dab4517f8ed3adc0fc9a
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous external URIs and is identified as a link farm hosted on disposable domains, suggesting an attempt to redirect users to malicious content. The document body is heavily obfuscated and appears to contain metadata rather than user-facing content, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wb?keyword=definition%20listless%20sentence PDF link annotation
    • https://cdn.sqhk.co/kixalixu/cibbfMZ/mozeturujekolit.pdfIn PDF document text
    • https://cdn.sqhk.co/baxorurifina/jRgjCjj/menu_costing_template_uk.pdfIn PDF document text
    • https://cdn.sqhk.co/pinebiven/hic1RSt/penopoz.pdfIn PDF document text
    • https://cdn.sqhk.co/lipebefaje/jjhgja5/rock_freedom_songs.pdfIn PDF document text
    • http://ourfanz.com/846844619794r1c0.pdfIn PDF document text
    • http://prognoz-football.club/24695935674h3kfw.pdfIn PDF document text
    • http://itagreen.fun/femabonegimeda2x0kd.pdfIn PDF document text
    • https://cdn.sqhk.co/boxoveru/5hhjjib/happy_birthday_video_maker_with_song_app.pdfIn PDF document text
    • http://espaceabonnes.com/kurodudimalawujevonabutxii.pdfIn PDF document text
    • http://ecoservice-vlad.ru/lu_177_dotatate_therapy_guidelines8x39i.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/87a4eefd-9d56-4705-98d0-7a65cc94c5ce/zevefijodigelen.pdfIn PDF document text
    • https://s3.amazonaws.com/fifuto/bromley_high_school_sixth_form.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2141d714-5263-41db-a548-3932f2892a6a/what_is_a_esoteric.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a973fd53-481a-479f-8315-181f1e787a7b/how_to_cook_steak_in_air_fryer_oven.pdfIn PDF document text
    • https://1350f94c-8d6f-42b4-8351-24983ad6a49a.filesusr.com/ugd/4aae87_ce89aec4387c4819a3a55048bff1470d.pdf?index=trueIn PDF document text
    • https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_7c58397e258f4746a2cdf11893856d99.pdf?index=trueIn PDF document text
    • https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_01abc3d25bcb466bb7b447248e2c01f4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/topipovikapari/any_kd_mini-protean_tgx_precast_protein_gels.pdfIn PDF document text
    • https://27158da8-170d-48ca-a528-b8ced62fe517.filesusr.com/ugd/9fc8c3_9fb5336bbee649eeba1e457920b60902.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd28d0f6-0b8d-4e9b-9bdb-d171fbf10728/powerful_prayer_sermon_outline.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66f598ee-ea80-43eb-bf63-d90e63f1a0ac/23605180627.pdfIn PDF document text
    • https://a694a867-b0fa-45cd-b082-7f9abf80b1a7.filesusr.com/ugd/430cb2_f90e2fca33f547bdab3b358298e18941.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/ragejufa/guwiv.pdfIn PDF document text
    • https://eda15335-3b41-4752-a6ea-ca28a3d9ec24.filesusr.com/ugd/db55a9_35315a41d5a44b8f9d5f6a3991c85fd5.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fukezavazuj/dokovabumagoke.pdfIn PDF document text
    • https://s3.amazonaws.com/bakoloj/mobuxot.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010024.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10024 4356 bytes
SHA-256: 5887a6340283404c8fd8d738ab52eb112c43e992df9d695f3ae214d0e9fc21a8
font_01_sfnt_off00010f07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F07 10988 bytes
SHA-256: 3de1bea8b4b2b87f0a441983ee1dbd11055e5a8ab37e74c408a711bdbd506c00
font_02_sfnt_off00013462.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13462 4324 bytes
SHA-256: ad623bc7c681097dfa1224999cf6cc6072d3ca9a137655dc1129b0261f0b357c

Open this report in the interactive analyzer, or submit your own file for analysis.