Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea3d12382d3abfef…

MALICIOUS

PDF

101.1 KB Created: 2021-03-20 08:42:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: e33c78606460176c059ef9904c5e7b84 SHA-1: a7fd5edb45aa4e4a5ae16b75bd3a8e60fa913259 SHA-256: ea3d12382d3abfef9aecd36824df973d2ce66e7f26e49dc72cd3423e804e73b4
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many of which are hosted on disposable domains and appear to be part of a link farm designed to obscure the ultimate destination. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic suggests the document may be instructing the user to decrypt or access an archive, a common tactic to bypass gateway security. ClamAV detection and ML classification strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9959

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=fleck+5600+sxt+not+filling+brine+tank PDF link annotation
    • http://xteenware.online/melewamuxujanen1ojz8.pdfIn PDF document text
    • http://arfeshome.com/47575373528vuk6r.pdfIn PDF document text
    • https://cdn.sqhk.co/lukisebeka/hhhaiiE/44679021597.pdfIn PDF document text
    • http://abistrans.ru/dusuvenaberinixijumitartoelw.pdfIn PDF document text
    • https://cdn.sqhk.co/tasokuxu/c8pigi7/88385542259.pdfIn PDF document text
    • https://cdn.sqhk.co/wefopijupe/gg2hfr6/uranus_retrograde_meaning_2020.pdfIn PDF document text
    • http://liketsven.xyz/voice_synthesizer_application_androidpz3gu.pdfIn PDF document text
    • http://itdiscount.pro/834852075296khqr.pdfIn PDF document text
    • http://good-production20.site/economic_census_2019_examb3g37.pdfIn PDF document text
    • https://cdn.sqhk.co/zovaratigu/ge5AjfK/glitter_mermaid_coloring_pages_barbie.pdfIn PDF document text
    • http://mpvideo.org/ipad_mini_5_2019_sizealx2d.pdfIn PDF document text
    • http://italywow.pro/can_covid_cause_high_bpfbtyx.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://fuxunefilat.epizy.com/android_arsenal_expandable_recyclerview.pdfIn PDF document text
    • https://03f57db0-fbcf-46ec-8713-21b5992b8512.filesusr.com/ugd/455f95_8d8698e331484141abf6360be4ec2afb.pdf?index=trueIn PDF document text
    • http://baruluzibovog.epizy.com/watch_the_trumpet_of_the_swan_full_movie_online_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07b77c99-346a-433d-9df9-4915e8bfa0f1/american_megatrends_bios_password.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ff98bab-3343-4a1c-a45f-c3263de51b12/39949293890.pdfIn PDF document text
    • https://af431a04-9ebc-4ea4-a98d-45e4ffbfad14.filesusr.com/ugd/485053_c0df0a5ea74840249c1bfa8139d4bd76.pdf?index=trueIn PDF document text
    • https://8ecf7690-1f99-4e28-a4b6-3228ba9731d7.filesusr.com/ugd/63d3ad_064b8b3b9ac744ce86ae714cf0622e6e.pdf?index=trueIn PDF document text
    • https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_8f43f73ec27943aeb0a443676c44f9b2.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1805969-ba71-4334-a1cf-581317d82b59/what_is_the_strength_perspective_in_social_work.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ada5ad24-0b72-4fe3-bca8-c714d004461d/8603594806.pdfIn PDF document text
    • http://zujofogu.epizy.com/22944284582.pdfIn PDF document text
    • https://2c5a832e-93c4-4ab0-bef0-969ef348d747.filesusr.com/ugd/cc5daa_97a7d3d61ad04b7bbfda328d0a000e61.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010521.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10521 3624 bytes
SHA-256: c655eb546a1b1acd2bfe31aec2d2a327658c5db1df35dd0db363eba141f5d2ae
font_01_sfnt_off0001120c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1120C 5696 bytes
SHA-256: e509f8827860dcf7b7291b6b5dbc7c6f4b23e4be167e658f2c67d4b6d740501b
font_02_sfnt_off0001258f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1258F 13996 bytes
SHA-256: fa0077f6f20b1833388da2a4f3b2b0768e8bf2ae806bc06a211a3e6c6cad4b48
font_03_sfnt_off000153e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x153E2 16848 bytes
SHA-256: ca5dd389e6a44484138ebd675bace0f621bc5c04ee734aae0aff76deb309d2de
font_04_sfnt_off00016bf0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16BF0 2428 bytes
SHA-256: 51118544fc45efba977f1b774d45d1608a45b8426f0c4f9045bbf80900c2a07a
font_05_sfnt_off000175c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x175C3 6112 bytes
SHA-256: 4cba390a9286515555924b8e49868e655b6a26feef553aa77f2174ca0c04bc69

Open this report in the interactive analyzer, or submit your own file for analysis.