Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee206c8d1c8b3d03…

MALICIOUS

PDF

113.2 KB Created: 2021-03-30 02:49:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: a866e9381fd4fe981ce807ee1e3b603d SHA-1: 66d5de580bbd0a469e9afdd6bd001e82875cb976 SHA-256: ee206c8d1c8b3d03b948b500c234feb947ecc84235cd262e7a3118dfd5d19b0a
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it functions as a link farm, with numerous embedded URLs pointing to disposable hosting. The presence of external URIs and the link farm heuristic strongly suggest an attempt to redirect users to malicious sites for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9708

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wix?keyword=eid+ul+adha+2014+date+in+pakistan PDF link annotation
    • http://ru-payment.casa/83066435261avez8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446925/normal_5fcce67246aeb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401985/normal_6041f43fbde6c.pdfIn PDF document text
    • https://cdn.sqhk.co/pigexebobe/JmgiigK/flat_zombies_defense_cleanup.pdfIn PDF document text
    • https://migofaxukov.weebly.com/uploads/1/3/5/3/135394112/xopisoduvesuli_zugotebomit_fovote_dovipo.pdfIn PDF document text
    • http://moreprodukti.com/how_to_bend_a_45_degree_offsetzpb92.pdfIn PDF document text
    • http://bbbbbbbbeeee.space/cobs_bakery_nutritional_informationkiy2q.pdfIn PDF document text
    • https://cdn.sqhk.co/tononapiwaso/zjeWkgU/tilanozu.pdfIn PDF document text
    • https://juxagoneponux.weebly.com/uploads/1/3/1/3/131384300/misavutu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386836/normal_6009d9a1a98ef.pdfIn PDF document text
    • https://cdn.sqhk.co/pebekaja/euoihhc/strategy_and_tactics_medieval_wars_game.pdfIn PDF document text
    • https://cdn.sqhk.co/jukowejazus/mWhh1hj/39384711495.pdfIn PDF document text
    • https://vojonabof.weebly.com/uploads/1/3/1/3/131383251/ccf5cf4ffad663.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405654/normal_605502d8f31e3.pdfIn PDF document text
    • https://sedozexejelem.weebly.com/uploads/1/3/1/8/131871533/gigimanuwopubut.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://jeburam.epizy.com/tugikuwigopetobolem.pdfIn PDF document text
    • https://s3.amazonaws.com/doxifuba/reasons_on_why_school_uniforms_are_good.pdfIn PDF document text
    • http://jefesipi.rf.gd/basic_electronics_ppt.pdfIn PDF document text
    • https://s3.amazonaws.com/fadadedezeker/95172724617.pdfIn PDF document text
    • https://s3.amazonaws.com/divikufifir/wamenatinaxavenenulum.pdfIn PDF document text
    • http://fosixijikalapi.epizy.com/logevimotolinivo.pdfIn PDF document text
    • http://vurosija.epizy.com/pulse_code_modulation_notes.pdfIn PDF document text
    • https://s3.amazonaws.com/bisiku/gizabinotejirepuxofik.pdfIn PDF document text
    • https://s3.amazonaws.com/lemerisinivum/58495915130.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off00018580.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18580 20128 bytes
SHA-256: 5e5b86f3e58b80094a91f2bb00650e202ccc4d4efc205262487d15bddf0b2e5d
font_00_sfnt_off0000fb00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB00 4376 bytes
SHA-256: 143a7bd3267953323eb70ad32475d320c0cface5a9ba97d05c98e46a4b5c212d
font_01_sfnt_off00010a52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A52 5384 bytes
SHA-256: de82a14f814a03879b3f8fcdb7d58ff360429a55ea649a1e35ac4351e08ca2db
font_02_sfnt_off00011ca8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CA8 6060 bytes
SHA-256: cc056e7c7c1371646a26ebe600b36ef63e4691a2ca800259b3d4fd50a7ce523c
font_03_sfnt_off00013084.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13084 3792 bytes
SHA-256: f77f631cdc83e39760ee60c6eeaeb78bb0169624c8f3b62e42186955fdfea5de
font_04_sfnt_off00013edd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13EDD 2380 bytes
SHA-256: 81cde0b16b26761a6b06cfb7087952f3735e0b8c540f54dc7d0f2108ce0aa8a9
font_05_sfnt_off000149c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x149C8 5452 bytes
SHA-256: e6abfd6a81463936e7b44c811060b67f11988128b9250121a7970bf8a1eecd15
font_06_sfnt_off00015cd8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15CD8 12376 bytes
SHA-256: 22206293a444f11e3729cc19175ac346245a79ad84747d05710daef62bdd8998
font_08_sfnt_off0001a717.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A717 3416 bytes
SHA-256: 16935f3d8d56e8300621c2808fc4db63b98ef5c1b0fc6887b91b89f6d430eb74

Open this report in the interactive analyzer, or submit your own file for analysis.