Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef8326e5aee2eff4…

MALICIOUS

PDF

86.0 KB Created: 2021-01-21 08:41:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: f50a86875c7dde1b06b4731566780fd5 SHA-1: b58e4e71dd5dd5f784de57eb1601a0bb7f348f9f SHA-256: ef8326e5aee2eff4f76f0a66fb7f5c45690434cd047df9cdf13084142a907ea1
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains numerous links to external websites, with one critical heuristic identifying a link to known malicious redirector infrastructure. The ML classifier and ClamAV also flagged this PDF as malicious, indicating a phishing or malware distribution attempt. The document body, though partially corrupted, suggests a lure related to an essay, likely to trick users into clicking the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/123?utm_term=essay+by+ralph+waldo+emerson In PDF document text
    • https://lirodute.weebly.com/uploads/1/3/1/8/131871659/938249f8751b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454182/normal_5ffc02d8e8da1.pdfIn PDF document text
    • https://cdn.sqhk.co/fovipobex/veijcpZ/98979193809.pdfIn PDF document text
    • https://dorulitonen.weebly.com/uploads/1/3/1/3/131380258/waribomaj.pdfIn PDF document text
    • https://cdn.sqhk.co/biluvetizom/6tbbljj/vuxapikijusi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375070/normal_5f8c9b9b6890a.pdfIn PDF document text
    • https://cdn.sqhk.co/niserutom/gofcjr5/samsung_s10_qr_scanner_funktioniert_nicht.pdfIn PDF document text
    • https://wisejagu.weebly.com/uploads/1/3/4/8/134881465/3947271.pdfIn PDF document text
    • https://cdn.sqhk.co/ganuniwiku/dgh47gj/smashbox_makeup_brushes.pdfIn PDF document text
    • https://cdn.sqhk.co/jemowevu/hghjjek/29923895473.pdfIn PDF document text
    • https://cdn.sqhk.co/sezogitov/UifhLgg/like_app_video_player_download.pdfIn PDF document text
    • https://rikelakejif.weebly.com/uploads/1/3/4/8/134885243/ebc9f1e3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xojafemori/61813210110.pdfIn PDF document text
    • https://s3.amazonaws.com/bisiku/microsoft_connectivity_analyzer_tool_windows_10.pdfIn PDF document text
    • https://s3.amazonaws.com/donarepemi/fellsmere_reservoir_fishing_report.pdfIn PDF document text
    • https://s3.amazonaws.com/jupoti/cabramatta_west_public_school_uniform.pdfIn PDF document text
    • https://s3.amazonaws.com/rerinago/nesetiwapapudukuxevot.pdfIn PDF document text
    • https://s3.amazonaws.com/tokit/bexaro.pdfIn PDF document text
    • https://s3.amazonaws.com/tojazudibumogab/macaron_template_1._25.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000114ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114EE 5488 bytes
SHA-256: fe8f34eeb5c989de75d57c0b87b107a0a51a3de526343f389ba6b0eabf9e283f
font_01_sfnt_off00012781.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12781 10272 bytes
SHA-256: 450204bbc0c943fd8c3f8106f75e004a10861499cb500e7a170a5a33a05912a2

Open this report in the interactive analyzer, or submit your own file for analysis.