Malicious PDF — malware analysis report

Static analysis result for SHA-256 f39d43bb8bc500ef…

MALICIOUS

PDF

103.9 KB Created: 2021-04-06 09:51:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 00dbab6dec2234c78aa4ebf7e5c39a57 SHA-1: ba8945fcb6669972f95c5c86d1351ca6c7d4e847 SHA-256: f39d43bb8bc500ef391e019db8c0ae5fa9468efd7bbabf828bffe912ca1d73c3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that points to a domain associated with phishing and scamming activities. The document's content, though heavily obfuscated, appears to be a lure related to legal information to entice users to click the malicious link. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=alabama+abortion+law+details+pdf PDF link annotation
    • http://passive-income.ru/bosch_glm_80_professional_laser_measuregyvra.pdfIn PDF document text
    • http://vaxiliwu.medianewsonline.com/2005_honda_accord_maintenance_light_flashing.pdfIn PDF document text
    • http://it50discount.pro/how_to_get_trophies_in_goat_simulator_payday1och3.pdfIn PDF document text
    • http://zafikapasipugog.medianewsonline.com/sowifosud.pdfIn PDF document text
    • http://velesvoyage.ru/lelobetejez3cpwn.pdfIn PDF document text
    • http://sukuwodexi.scienceontheweb.net/zuganomodujovaxijeto.pdfIn PDF document text
    • http://localdesign.me/list_popular_operating_systems_for_computers_and_mobile_devicesbvhaq.pdfIn PDF document text
    • http://lnstagramverifiedsbadgeform.com/jean_valjean_les_mis_cast_london4uhxa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://e5eb5b25-b33c-43e3-82d5-57ab1bf863d8.filesusr.com/ugd/b0c717_bdb321c72a234807aa8a414c44df9faa.pdf?index=trueIn PDF document text
    • http://laxolagodofomug.onlinewebshop.net/jusokojo.pdfIn PDF document text
    • https://0e733887-fd72-4d21-8b10-0a39cafbc931.filesusr.com/ugd/1e4d10_1e99cab9641c44a89073a1cd5b3c7dda.pdf?index=trueIn PDF document text
    • https://75ca6b5e-a470-4e0e-8004-b00a9f1721b4.filesusr.com/ugd/1e4819_ebd6209eb58546fb96b7fcca1ebf59b9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d85684e3-8eeb-46be-b15b-025ce4364211/78630539165.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d1a0ffe-3fe1-4726-b7b3-f48f6d76de37/navien_ch_180_error_codes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ef165a0-1d59-49c1-8031-20a2d0b09ce8/56818497371.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1d83777-a827-4270-8310-3d99e9962162/25_yoga_poses_for_beginners_chart.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02bc4428-5be1-432f-9fdb-59361e0c465f/tefavitodinuji.pdfIn PDF document text
    • http://negumigimewote.onlinewebshop.net/astm_a193_b16.pdfIn PDF document text
    • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_495396704ee64c03a0e81ff42e49a6b9.pdf?index=trueIn PDF document text
    • https://5a995288-ce6f-4ae3-a3e6-14272d8003db.filesusr.com/ugd/7be1cd_28d1f572036f4ab88c8fd3afdaa7c8ac.pdf?index=trueIn PDF document text
    • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_8f4b4d1a7ff34ebe984a969eee2a748e.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001594f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1594F 5408 bytes
SHA-256: ad8d8b1a011e4467c2775b00a71dc937a875cb69d2dc437dd211a90aa7488f28
font_01_sfnt_off00016ba3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16BA3 11388 bytes
SHA-256: 7f139764896e23452d8234bf786a1605be91e0b6f404004e2945f7517d42df10

Open this report in the interactive analyzer, or submit your own file for analysis.