Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0e445cd0ed75343…

MALICIOUS

PDF

77.8 KB Created: 2021-04-15 21:56:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a9103ed0062d99934e263a4021bd7eb7 SHA-1: bebd8c001eb051bcbf3cf99341ea8bcd63b5d4a5 SHA-256: f0e445cd0ed75343fb652c695701ca0631be85550e9c560ed3ae206f775ff3ad
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or scam attempt. It contains numerous external links, forming a link farm, and one prominent URL that appears to be a lure related to refrigerator maintenance. The presence of embedded URLs and the overall structure suggest an attempt to redirect users to malicious or deceptive websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=how+do+you+reset+the+filter+light+on+my+samsung+refrigerator
    • https://nedosadowizo.weebly.com/uploads/1/3/5/3/135347652/sogolez.pdf
    • https://cdn-cms.f-static.net/uploads/4459628/normal_605867c94ad6e.pdf
    • http://madawuboso.sportsontheweb.net/immanuel_kant_books_in_hindi.pdf
    • https://cdn-cms.f-static.net/uploads/4454290/normal_6041fd4fbe887.pdf
    • https://xatiletovolut.weebly.com/uploads/1/3/1/4/131409128/2326912.pdf
    • https://fuvipizewovotat.weebly.com/uploads/1/3/1/0/131069886/paxoku_sezufebix_rowulu_sokimowovos.pdf
    • https://cdn-cms.f-static.net/uploads/4481420/normal_602ae11eb33a9.pdf
    • https://pipepolubewaxa.weebly.com/uploads/1/3/4/7/134709371/d068ec52505fda3.pdf
    • http://wuwodijutorem.iblogger.org/turbochef_fire_pizza_oven_price.pdf
    • https://static.s123-cdn-static.com/uploads/4421461/normal_600607574b6bd.pdf
    • https://kumobavubisu.weebly.com/uploads/1/3/0/7/130775432/55e173e0594f38b.pdf
    • https://static.s123-cdn-static.com/uploads/4420930/normal_5fcaa9702b804.pdf
    • https://zawimadugujesu.weebly.com/uploads/1/3/4/7/134713294/51745883d.pdf
    • https://lifulufo.weebly.com/uploads/1/3/1/3/131379971/sikufo.pdf
    • https://fufukarebalomok.weebly.com/uploads/1/3/4/3/134352968/adfd02cb4953a.pdf
    • https://vilofezilo.weebly.com/uploads/1/3/0/7/130740065/6213591.pdf
    • http://wabaxifejem.sportsontheweb.net/reliability_centered_maintenance_download.pdf
    • https://bunavomotuta.weebly.com/uploads/1/3/4/6/134606544/mugev_galiloleviwuned_zodisi_suderixa.pdf
    • http://xawikeroteguvu.iblogger.org/57321059539.pdf
    • https://static.s123-cdn-static.com/uploads/4472783/normal_6002a67808f3e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://larovitivejel.atwebpages.com/15786364478.pdf
    • http://tasaronusofake.rf.gd/canberra_times_sports_submission_form.pdf
    • http://tuzuxutetug.atwebpages.com/carmilla_gratis.pdf
    • http://kopedug.epizy.com/3418368654.pdf
    • http://didazejitikav.rf.gd/fisher_and_paykel_dishdrawer_fault_code_a3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e599.bin
a068fd615a5595ce789655bf8ac306a13087ec0484554b1bd98b75e01b316d37		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE599 5360 bytes
font_01_sfnt_off0000f7b8.bin
31cbe0e8af8ce7f67f378acc01a29559d4a05516b3986d156c87a73b6e94db01		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7B8 10316 bytes
font_02_sfnt_off00011af4.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11AF4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.