Malicious PDF — malware analysis report

Static analysis result for SHA-256 f039d503d4808ee9…

MALICIOUS

PDF

85.8 KB Created: 2021-04-08 04:15:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d28053ddb71836bd5e6fa36cea1aa668 SHA-1: d86fefaa767f695a67b3c181c2398cf697790366 SHA-256: f039d503d4808ee939d6b833273c08ec37c4fb71295fea3d807d2f85ff8573e9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous external URIs, with a significant portion pointing to disposable hosting, suggesting a link farm designed to redirect users. One prominent URL, 'https://dafemum.ru/wix?keyword=shayri+in+hindi+font', is likely part of a phishing or malware distribution scheme. No scripts were extracted, but the PDF structure and numerous embedded URLs strongly suggest a malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=shayri+in+hindi+font
    • https://static.s123-cdn-static.com/uploads/4385198/normal_5ff418fd973bd.pdf
    • http://lezobul.medianewsonline.com/animator_s_survival_kit_richard_williams_download.pdf
    • http://kusafomidufe.mywebcommunity.org/25456748015.pdf
    • https://tidosivapozagul.weebly.com/uploads/1/3/4/3/134390518/laxonixobipale-xovurajekovuvib-vudozewuxujuwo-xenafiso.pdf
    • http://xusetifawog.mypressonline.com/kukamojuzop.pdf
    • http://palogaza.sportsontheweb.net/crise_addisoniana.pdf
    • http://zesaguzijor.mypressonline.com/55624599772.pdf
    • http://bamupiwabibajew.mywebcommunity.org/child_development_and_pedagogy_download.pdf
    • https://cdn-cms.f-static.net/uploads/4413109/normal_602c388c65a6b.pdf
    • https://xuwosanilenerev.weebly.com/uploads/1/3/4/9/134900173/jilebagovo_mabuxoko_zonofefokoxow.pdf
    • https://cdn-cms.f-static.net/uploads/4405437/normal_606090701cf7d.pdf
    • http://fidesuwuranotif.getenjoyment.net/basics_of_data_communication.pdf
    • https://static.s123-cdn-static.com/uploads/4413846/normal_5fc7e2ab4dfd7.pdf
    • https://wonelapafilujol.weebly.com/uploads/1/3/1/6/131606162/donutizifevajumewasa.pdf
    • https://static.s123-cdn-static.com/uploads/4464870/normal_5ffce0a188b4f.pdf
    • https://cdn-cms.f-static.net/uploads/4374519/normal_5fdbcaa36e882.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vogubivajavofu/ro_mobile_alchemist_job_change_guide.pdf
    • http://sorisavitekinuj.onlinewebshop.net/power_amplifier_mcq.pdf
    • https://s3.amazonaws.com/mudurixo/xenuwupekuxamevaliruvofu.pdf
    • https://s3.amazonaws.com/pazovugal/endospore_formation_in_bacteria_biology_discussion.pdf
    • http://limufij.myartsonline.com/39789583128.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb77.bin
647f1e8450945e5d3e0c2818d11048f2c4feba1fffb578f1453c243f8006d8f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB77 4992 bytes
font_01_sfnt_off00010c75.bin
4da730a8d87cbfa272644d7a97f4fec8719d0dd13f59b7dbaa23a19045c501c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C75 11196 bytes
font_02_sfnt_off000132d3.bin
5b1294b1d429b703a41b13ab65bf7f784e8ad133708c0dbb81f511f764b14254		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132D3 16560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.