Malicious PDF — malware analysis report

Static analysis result for SHA-256 eed45089e845a27c…

MALICIOUS

PDF

79.1 KB Created: 2021-03-14 23:57:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 3627b846da7f3d701740b87d005d4770 SHA-1: 25577b4f1cfb433b4f6bef6e400517e993347e75 SHA-256: eed45089e845a27cad917abdbbd1a23ccf720d42a670d41052a57fcd380dbd7b
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with one identified as a known malicious redirector. The document body, though heavily obfuscated, suggests a lure related to 'Toastmasters pathways general evaluation form'. The presence of numerous links on disposable hosting and a critical heuristic firing for a malicious redirector strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=toastmasters+pathways+general+evaluation+form In PDF document text
    • http://gewututikame.getenjoyment.net/me_before_you_full.pdfIn PDF document text
    • http://groshyk.site/printable_yard_sale_pricing_guide_201792ebz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391915/normal_60407f6d22afd.pdfIn PDF document text
    • http://polobasopika.mywebcommunity.org/54980477722.pdfIn PDF document text
    • http://sdek-24.cc/drum_studio_near_mewfrxw.pdfIn PDF document text
    • http://fragcups.com/grolier_international_americana_encyclopediazcds2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477651/normal_6020ad4e1af1b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371247/normal_6025785a4c0e3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450907/normal_5fcb3fd878245.pdfIn PDF document text
    • http://gprofights.ru/52461974831w3qxf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366327/normal_5fdef956c45dc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/2b1477ee-5131-4014-bc27-ec5766fb262d/afterlife_lyrics_future.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a80cae30-1145-4361-beb1-d04abe401b81/como_hacer_un_bosquejo_biblico_para_predicar.pdfIn PDF document text
    • https://71e5fc8e-cc9a-4633-96c3-2c70acd464d0.filesusr.com/ugd/f08e01_cff771329c7147179674c440e2ef31e6.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbf5b297-d654-454c-a428-ccedc762cd4d/what_does_a_blinking_orange_light_mean_on_an_ipod_shuffle.pdfIn PDF document text
    • http://gajopule.myartsonline.com/britax_boulevard_clicktight_front_facing_requirements.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d02ee08-d975-49cd-b9fd-372c07bd79e5/harry_potter_book_8_review.pdfIn PDF document text
    • https://5c126656-fc4f-473b-8c99-11744d2e1b96.filesusr.com/ugd/abd8ec_be6b44278c9b497180c5ca391ee50b4a.pdf?index=trueIn PDF document text
    • https://ba85394b-11ac-4ca4-926b-74ca936c52e1.filesusr.com/ugd/5ccfc8_54921b791f664a9c8917a918f3bf8455.pdf?index=trueIn PDF document text
    • https://89f68ddc-9f98-4e60-8afa-3e0ca6603e9e.filesusr.com/ugd/4725f1_e3ecfe0a71344db79b151b5fa6162f87.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbdd2822-3c8f-46dc-a451-41f83a2d8f82/2010_dodge_caliber_dash_light_meanings.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8DF 5400 bytes
SHA-256: 254133bea4d04229a7ed59d3ea7762571b9409f85229fb36ced43ba3ce4bf6fe
font_01_sfnt_off0000fb36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB36 10980 bytes
SHA-256: 482bd42d5f0559271e213df83927b0ee4f84300c6e2665c19b1152fce91f2917
font_02_sfnt_off0001203e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1203E 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.