Malicious PDF — malware analysis report

Static analysis result for SHA-256 fac00147904f98bc…

MALICIOUS

PDF

80.3 KB Created: 2021-04-22 08:12:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e2851f707d962b3f44c9a7a7e32bc1a SHA-1: 238852171dcbf6c1e217ce53159b728cdc299999 SHA-256: fac00147904f98bc05d212df23c3f148ca8c052296573b87fcdfd9d3fde62b93
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating it is likely a phishing or trojan delivery mechanism. The document body, though heavily obfuscated, contains references to 'Tintin comic books pdf free download' and the authoring application 'wkhtmltopdf', suggesting a lure for users seeking free content. The presence of numerous external URIs, many pointing to disposable hosting, further supports a link farm or phishing attack pattern designed to redirect users to malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=tintin+comic+books+pdf+free+download
    • https://pexaxodosusa.weebly.com/uploads/1/3/0/8/130874045/legegosogodagawej.pdf
    • http://mikapamaku.22web.org/84226281819.pdf
    • https://wogalipa.weebly.com/uploads/1/3/4/3/134316604/dapufob-vinovarorigolep-ditemana.pdf
    • http://bejisosubonito.sportsontheweb.net/denewa.pdf
    • http://toladidiripe.iblogger.org/why_is_my_wii_light_red.pdf
    • http://vujofinupapido.22web.org/poxidinapafezamusuduxarir.pdf
    • http://sinoxaju.mygamesonline.org/antiespasmdicos_anticolinrgicos.pdf
    • https://finuvowevemez.weebly.com/uploads/1/3/5/3/135397693/nonufozobamo_pagarofizixu_bamemisat.pdf
    • https://ninisajata.weebly.com/uploads/1/3/4/8/134869212/4707ece.pdf
    • http://sudebatuwilazet.iblogger.org/workforce_management_book.pdf
    • http://nedugitovo.iblogger.org/kupivavuga.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xefujexomige.epizy.com/98283028877.pdf
    • https://s3.amazonaws.com/xukirizugukugi/vegibuvozumodemu.pdf
    • http://wegorabeg.atwebpages.com/basket_case_bass_tab.pdf
    • https://uploads.strikinglycdn.com/files/faa00822-4461-4425-8039-0300229df292/87751840240.pdf
    • https://s3.amazonaws.com/fokapikow/adventist_songs_free.pdf
    • http://pusevim.epizy.com/guxofi.pdf
    • https://s3.amazonaws.com/pegebunov/66428649960.pdf
    • http://rusuditet.epizy.com/rf_power_amplifier_book.pdf
    • https://s3.amazonaws.com/xifabilejilab/how_much_money_does_charli_damelio_earn_from_tiktok.pdf
    • https://s3.amazonaws.com/fonazuzixagizir/73801960625.pdf
    • https://uploads.strikinglycdn.com/files/232a300f-662e-490e-9da4-892cbc133327/bijujekekubivolopozififo.pdf
    • https://uploads.strikinglycdn.com/files/09b56c1d-e798-433b-a2a2-5bfda42a5e38/1996_ford_ranger_led_headlights.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000facf.bin
942e8dc764496b4af4437ae8aa56b85ddaf76686134e21b20871164b8230efbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFACF 5548 bytes
font_01_sfnt_off00010da5.bin
02a14ce4c0eabbd53328b9ccd623c25212627e5574d47042627ebf0645bea66c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DA5 11252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.