Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4ecf4bd7f8b8ba1…

MALICIOUS

PDF

82.4 KB Created: 2021-03-18 23:47:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2bf3c53b374412f5dba18f2c22d0f8eb SHA-1: 971d52c30536ccb350345565984890dd5b3df763 SHA-256: f4ecf4bd7f8b8ba1a1d3707d3daaff2c57f1ce3d88718b818bfa3f26897838ef
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, many of which are part of a link farm hosted on disposable domains, suggesting an attempt to redirect users to malicious sites. The document body, though heavily obfuscated, appears to reference a book title, indicating a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=from+critical+thinking+to+argument+a+portable+guide+5th+edition+pdf
    • https://static.s123-cdn-static.com/uploads/4500674/normal_5feb5f3cc2b8c.pdf
    • https://cdn.sqhk.co/jusupovexewa/vIhc4ge/word_connect_game_answers.pdf
    • https://cdn.sqhk.co/bibikodazit/idviiie/43888088653.pdf
    • http://kazaxukiga.getenjoyment.net/childhood_immunization_schedule_2020.pdf
    • http://gasolotiravizid.sportsontheweb.net/cadenas_de_markov_ejemplos_resueltos.pdf
    • https://static.s123-cdn-static.com/uploads/4420239/normal_5fce842fd53c8.pdf
    • https://cdn.sqhk.co/munuluxel/iiihCja/83302412843.pdf
    • https://cdn-cms.f-static.net/uploads/4498997/normal_603a442847c83.pdf
    • https://cdn-cms.f-static.net/uploads/4462350/normal_60373d0cbf78c.pdf
    • https://cdn.sqhk.co/jekenilegefe/gdb0hes/mexican_liga_mx_team_logos.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/buxoparadazegu/nokilobuvuxika.pdf
    • https://a3c35cc3-4a3f-4d41-ab51-8b3e4b114d30.filesusr.com/ugd/2b25b5_021e0b918d0442aaae651daf9db83c12.pdf?index=true
    • https://1b3fde16-7575-45ba-b40e-8916c64185ca.filesusr.com/ugd/8874e8_da515fe533fc409e9141ddc5d8f4f7f4.pdf?index=true
    • https://f8071fb1-33dc-4bb9-9fe9-292e0ca0d861.filesusr.com/ugd/253000_62c59d43c0a649c3a963b30b8b3e4f72.pdf?index=true
    • https://24976a62-ea59-4ca6-8500-d0bd08f9a094.filesusr.com/ugd/65a075_c9acd01384a24c738c19e81ee50c53fb.pdf?index=true
    • https://s3.amazonaws.com/najubu/30316938794.pdf
    • https://s3.amazonaws.com/tokatefozude/weather_report_chelan_wa.pdf
    • https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_c91dae5e57974d12a5f6e969807d813f.pdf?index=true
    • https://7a48fde5-f9d1-4ce4-84a2-8b156d245d18.filesusr.com/ugd/8127dd_70fd4507a0644a109f2df70585fa800c.pdf?index=true
    • https://s3.amazonaws.com/nilafafakem/proof_of_service_federal_court_form.pdf
    • https://6525eaf8-9a42-4119-9fb4-c3d475b3b78e.filesusr.com/ugd/80bfa9_9c8ea1429076451991049f25093d6a1f.pdf?index=true
    • https://a4edf7fa-b057-49b5-8014-e5fd436fbef3.filesusr.com/ugd/c8b2c5_cb13bdb5a1444d68bb620855aa15a54e.pdf?index=true
    • https://d2faa26e-66ca-44cd-8f84-883624a71019.filesusr.com/ugd/dbbfd0_dcceeaf8bc1e4b1cb3da3fdd74f5fe13.pdf?index=true
    • https://s3.amazonaws.com/mizeteb/how_do_i_program_my_remote_to_my_cable_box_spectrum.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fda3.bin
6773892d725f1753a4c7b7bd9a3b3bbbaed5e2321fb0897ca8956cf1b7c8b918		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDA3 5672 bytes
font_01_sfnt_off000110c4.bin
cdb71ec7da7e3018c3a43e3c9efbd9553a85d12535472492e1a8df4bb1ef023c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110C4 12064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.