Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb9af2a017afc162…

MALICIOUS

PDF

63.9 KB Created: 2021-03-31 13:56:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 788b2a53d84c1db92cdfc49d4a7a6db5 SHA-1: aea44bf417bbcda98197eb952bc3a3f795ddc9be SHA-256: eb9af2a017afc1625858340b60739c1cb9e4825b85fff5059fb981ce1cc515d0
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many pointing to disposable hosting and link farms, indicating a phishing or malware distribution attempt. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' and the ML classifier strongly suggest malicious intent. The document body, though heavily obfuscated, contains text related to 'obamacare' and 'wkhtmltopdf', suggesting a lure to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8273

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=how+much+to+qualify+for+obamacare PDF link annotation
    • https://cdn.sqhk.co/sixepatexup/Tghixia/49932234719.pdfIn PDF document text
    • http://tivewuba.iblogger.org/64845367177.pdfIn PDF document text
    • https://cdn.sqhk.co/wakewafo/jblihhj/31932806622.pdfIn PDF document text
    • http://jezolagewe.iblogger.org/answer_australian_pronunciation.pdfIn PDF document text
    • https://cdn.sqhk.co/fekoguwiwu/dQSOWJo/zibugipawojewibome.pdfIn PDF document text
    • https://cdn.sqhk.co/xadowififux/EIR6tja/lizard_beans_leopard_gecko_care_sheet.pdfIn PDF document text
    • http://medway24.com/carbon_steel_typesm6s3r.pdfIn PDF document text
    • http://optamorem.com/mitupediwogonabefatocp111.pdfIn PDF document text
    • http://bijatutolime.iblogger.org/process_improvement_plan_template_word.pdfIn PDF document text
    • https://cdn.sqhk.co/gikokimofegi/gifhhW1/pefemosorinuvo.pdfIn PDF document text
    • http://menformula.xyz/setur9mdx7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/ligole/65405591732.pdfIn PDF document text
    • https://s3.amazonaws.com/degisapemifa/junazuvezelubelobav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/891e7459-421d-4d28-80cb-866b5d5752b7/how_to_set_up_graco_pack_and_play_with_bassinet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbe054d9-0226-488e-81d2-4b06bdf77783/44256008522.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/690009fa-b68c-4406-af8a-b89cddae1e80/bavenixetaxopikipavuxogap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/951ade87-6f94-4752-9ad4-b663914f39ee/72179239290.pdfIn PDF document text
    • https://s3.amazonaws.com/niwotipugonuvoz/59597107251.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bbc8a30-c6e7-44bc-bd21-eec5d5587a2a/material_science_internship_uk.pdfIn PDF document text
    • https://s3.amazonaws.com/wixamupelinere/play_store_apk_upload.pdfIn PDF document text
    • https://s3.amazonaws.com/pibabopuduj/lansweeper_helpdesk_reporting.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eaab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAAB 5364 bytes
SHA-256: c9ea3bea13cad4270d499bea2cd553636e4168991446d5f65f9e7597e439954a

Open this report in the interactive analyzer, or submit your own file for analysis.