Malicious PDF — malware analysis report

Static analysis result for SHA-256 eac958befe2073ca…

MALICIOUS

PDF

70.9 KB Created: 2021-03-15 14:50:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 216928ce4cfd54bbafbf0752247157e2 SHA-1: e694176c1c8baf93fc3f6e7a4fd9144aaa8abe30 SHA-256: eac958befe2073ca475e9814e41ef1e5188459b044ab097c038c85a23eac657d
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous external links, with one specifically pointing to a keyword-based URL that suggests a lure for users searching for specific information. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDF documents from web content, further supporting the idea of a web-based lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=projectile+simulation+worksheet+answers
    • https://cdn-cms.f-static.net/uploads/4474218/normal_5fd15d25e748f.pdf
    • http://golosa-spasibo.ru/what_is_an_interior_car_detailexnpr.pdf
    • http://azakalaza5.xyz/bodybuilding_motivation_video_statuss3i9g.pdf
    • https://cdn.sqhk.co/nobukomorur/ciisTUx/zuvutodixexopegunitub.pdf
    • http://gekiwejal.scienceontheweb.net/changing_to_word_on_ipad.pdf
    • https://cdn.sqhk.co/dirajafowevo/ijPhj9K/god_of_war_gameplay_guide.pdf
    • http://fibiver.mygamesonline.org/cadette_animal_helpers_badge_requirements.pdf
    • http://vizojuzoninunoz.scienceontheweb.net/tanukumux.pdf
    • http://reduslim-italiaofficial.site/zen_pinball_williams_ioscky8a.pdf
    • https://cdn.sqhk.co/fewukise/1gdii9h/space_program_tribe_called_quest.pdf
    • https://cdn.sqhk.co/tirewaku/A5oijnw/66837904926.pdf
    • https://cdn-cms.f-static.net/uploads/4449771/normal_6022e00e938e3.pdf
    • http://tejasatobes.medianewsonline.com/blueprints_medicine_6th_edition_download.pdf
    • https://static.s123-cdn-static.com/uploads/4466161/normal_5fcc76a6d7623.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0aa989e7-076c-475f-bc22-fff5ae310860.filesusr.com/ugd/b44be6_18e381925e73424d9441dd8ab1921af7.pdf?index=true
    • https://f8206d31-21c4-4aef-9da9-e4259ded718a.filesusr.com/ugd/c2bdac_93536008f24e48a585230edcb9323bbc.pdf?index=true
    • http://boxijekew.atwebpages.com/rasaninamatolawapofif.pdf
    • http://dofadedivuxira.rf.gd/september_2020_calendar_printable.pdf
    • http://kodasakame.rf.gd/45640322031.pdf
    • http://xigufogadenake.epizy.com/disguised_remuneration_loan_charge_reporting_requirements.pdf
    • https://7162f0c1-3bb2-4775-9ad2-1e34613fb889.filesusr.com/ugd/595093_2d9d208df3a244c49348c083f73fcd03.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6a5.bin
ae19987ef3841becc1b2d0a88cc3c63ac365955ffb255ca0fbf0d9cf4f9efc0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6A5 5272 bytes
font_01_sfnt_off0000e873.bin
fcf9b8e4b5f0482aa71c88e97ee95dc5d65ac13a8b0ec53d8dcd5c25c8fe37c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE873 10996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.