Malicious PDF — malware analysis report

Static analysis result for SHA-256 f07d8581632b6b6d…

MALICIOUS

PDF

79.0 KB Created: 2021-03-18 14:04:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a8eb4df3edc741ac870abcd2f31cfdd SHA-1: d8c781bf32c3b3de4484bd421678b16d71bbe5f5 SHA-256: f07d8581632b6b6da1f7e80b987558c09073280315fcc6bddaa124d311dd1705
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a URL that appears to be a link farm, likely intended to redirect users to malicious content. The document body, though heavily obfuscated, contains terms related to software cracking, suggesting a lure for downloading unauthorized software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/123?utm_term=bandicam+crackeado+2016
    • https://gapidekejoz.weebly.com/uploads/1/3/4/8/134876705/9974483.pdf
    • http://biwejobezimije.22web.org/2881445098.pdf
    • https://xisagoruno.weebly.com/uploads/1/3/5/3/135332800/gilevukijesed.pdf
    • http://dedevolopi.iblogger.org/pegegidirev.pdf
    • https://lelopotive.weebly.com/uploads/1/3/0/7/130738546/6016488.pdf
    • http://tojagetuwiger.iblogger.org/como_hacer_una_maqueta_del_modelo_atmico_de_bohr.pdf
    • https://rikatawifusozib.weebly.com/uploads/1/3/1/4/131409861/gefuwotojijegiziruk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mudiwedazefuveg.rf.gd/silsila_ye_chahat_ka_song_pagalworld.pdf
    • https://s3.amazonaws.com/nitajosasa/contra-_histria_do_liberalismo.pdf
    • https://uploads.strikinglycdn.com/files/d26e4d40-6b42-4895-bda4-c551776f5320/how_to_properly_chant_nam_myoho_renge_kyo.pdf
    • http://bikaxubu.rf.gd/how_to_be_a_3_man_book_review.pdf
    • https://uploads.strikinglycdn.com/files/ceee3c0a-a553-4bd9-9ae6-182fef92b6ce/how_do_you_say_goodbye_in_native_american_language.pdf
    • https://b4140449-9b96-4148-8619-c9b3eed7b48c.filesusr.com/ugd/c33cdb_1e3bddbf745c41079aeb392ca8121ea1.pdf?index=true
    • https://s3.amazonaws.com/tamobalasu/what_is_the_best_underseat_luggage.pdf
    • https://80b2a579-f9ed-4aa0-b91a-ac3c8973c086.filesusr.com/ugd/353d00_e154446c41c54282ab156d13b296e812.pdf?index=true
    • http://newosanovaf.epizy.com/intake_and_output_practice_sheets.pdf
    • https://f26e6bca-ce10-4524-9610-ed5ef7c8d48b.filesusr.com/ugd/ac8c68_f723e5fa3b0044adb42378d3571d1b27.pdf?index=true
    • http://mujunuge.rf.gd/best_free_movie_sites_no_registration.pdf
    • http://kebafitesulodu.epizy.com/vsco_x_apk_for_ios.pdf
    • https://8271b8e8-1520-4b18-8785-2fafc8cd33e6.filesusr.com/ugd/efc97f_e621b81cdd6b4f959bff62d0cd702acf.pdf?index=true
    • http://tizelimanux.rf.gd/rivitakasotan.pdf
    • http://pejinubonuxus.epizy.com/brahmotsavam_telugu_movie_audio_songs.pdf
    • https://uploads.strikinglycdn.com/files/1c3fa7e9-e42b-449c-a040-0062c0ac420e/garfield_his_nine_lives_movie.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f244.bin
ceb6eed616d8d92c9b9a4226f5473d38540d67f31ab691c3976a415f4dac636f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF244 5468 bytes
font_01_sfnt_off000104ce.bin
2e0c14528e1a4a869cd2ebe5dba21efdf1507fab7f3cb370dd11a2fc90ab236d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104CE 12920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.