Malicious PDF — malware analysis report

Static analysis result for SHA-256 f82b880411256b08…

MALICIOUS

PDF

88.7 KB Created: 2021-03-01 21:09:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04
MD5: c8cfcc99c4d2ab7acbba5d7724185eb9 SHA-1: b90c9f4ee57340ad9cd0cafed001ecfa048f7ad4 SHA-256: f82b880411256b08c9cec41012826a5743561b1349ed3aa668c48eb26036e9d8
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The PDF contains numerous embedded links pointing to external domains, suggesting it functions as a link farm or phishing lure. The presence of external URIs and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic strongly suggest the document's primary purpose is to redirect users to potentially malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=dead+trigger+2+all+weapons+apk PDF link annotation
    • http://pawarelubasiwu.iblogger.org/atkins_phase_3_food_list.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474722/normal_5fcb55cd03c41.pdfIn PDF document text
    • https://tuboxivodase.weebly.com/uploads/1/3/4/3/134387713/wevujulofudalosa.pdfIn PDF document text
    • http://kojazunupetip.mygamesonline.org/4137873075.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483587/normal_6011b89eb0776.pdfIn PDF document text
    • https://niritopep.weebly.com/uploads/1/3/4/6/134634222/24eb827adc.pdfIn PDF document text
    • http://setlyb.online/aadhar_card_information_in_english4wlkx.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416786/normal_5fcae4c233cb3.pdfIn PDF document text
    • https://rigoxetevub.weebly.com/uploads/1/3/4/0/134017132/6140fc.pdfIn PDF document text
    • https://roxadaxakisa.weebly.com/uploads/1/3/1/4/131437443/d7d137cc1f5c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379487/normal_600daf4769f26.pdfIn PDF document text
    • http://lezigovedavide.getenjoyment.net/642090341.pdfIn PDF document text
    • http://organicnu.info/pexoxizegepuzofadopegiw4vrn.pdfIn PDF document text
    • http://0fruits.space/should_the_united_states_have_annexexawu7.pdfIn PDF document text
    • https://kasuvimifimo.weebly.com/uploads/1/3/1/6/131637099/ff88d8c4a35766.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://bivojeda.atwebpages.com/11739652516.pdfIn PDF document text
    • http://wivovazu.epizy.com/harry_potter_hogwarts_mystery_merula_duel_guide.pdfIn PDF document text
    • http://jigisasamupor.onlinewebshop.net/can_age_of_empires_2_run_on_windows_10.pdfIn PDF document text
    • http://xetixeguxiji.epizy.com/used_mtd_yard_machine_riding_mower_for_sale.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fda2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDA2 5204 bytes
SHA-256: b2ca9c50864adeed6a88c1cb5fcfca8372777e333749a870d90f978345196d19
font_01_sfnt_off00010f79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F79 10012 bytes
SHA-256: f5b9d5b9cf531a49701e0bea31b93d48602dbb02a5d81dd7c6e3ef66700c0566
font_02_sfnt_off00013209.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13209 16092 bytes
SHA-256: ea75db71c9df7250347a03039f742fcd189f5fc3f08964e696816fa8b5227073
font_03_sfnt_off000146d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x146D1 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.