Malicious PDF — malware analysis report

Static analysis result for SHA-256 fce6d5ec95a21990…

MALICIOUS

PDF

163.1 KB Created: 2021-04-03 15:39:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 816fe3894a8a854dcd7d4acf0d78c327 SHA-1: 561f0fed124dc9b8527c8c738cacecce55ff14a1 SHA-256: fce6d5ec95a219906847bc5e7aad0e350654c1c54ab88c34ec9e205bfad96efd
146 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ML classifiers and ClamAV as malicious, exhibiting characteristics of phishing and link farming. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of numerous embedded URLs points towards an attempt to redirect users to malicious sites. The 'SE_CALLBACK_LURE' heuristic specifically indicates a callback phishing or tech-support scam pattern, likely intended to trick the user into initiating a fraudulent phone call.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=texas+coach+teks+edition+algebra+1+answer+key+pdf PDF link annotation
    • https://vafopizinenited.weebly.com/uploads/1/3/4/4/134480139/5548951.pdfIn PDF document text
    • https://cdn.sqhk.co/xinefegepe/ip4hjE9/84638139170.pdfIn PDF document text
    • https://jizotigop.weebly.com/uploads/1/3/0/8/130874082/ziraxawufozotosazep.pdfIn PDF document text
    • https://cdn.sqhk.co/kajipazuto/iihf9FJ/pioneer_headphone_app.pdfIn PDF document text
    • http://kofojoxake.mygamesonline.org/how_to_install_a_riding_lawn_mower_battery.pdfIn PDF document text
    • http://bizifemodefi.mygamesonline.org/tamil_language_learning.pdfIn PDF document text
    • https://navemozozaju.weebly.com/uploads/1/3/1/1/131164567/dutanevifive.pdfIn PDF document text
    • http://jasazotinalol.mygamesonline.org/xanodowejawiveduxikeral.pdfIn PDF document text
    • https://saripubisopa.weebly.com/uploads/1/3/5/3/135322362/8d1814117c.pdfIn PDF document text
    • https://riligasiguvenu.weebly.com/uploads/1/3/5/3/135392009/7077843.pdfIn PDF document text
    • https://jojavofeze.weebly.com/uploads/1/3/4/3/134395471/zirolononaxowedafevo.pdfIn PDF document text
    • https://xavozunop.weebly.com/uploads/1/3/4/3/134305705/toginazoz-bolebizuganidib-fejivogapesosug-worivaxatij.pdfIn PDF document text
    • https://kobizixudowizeb.weebly.com/uploads/1/3/4/4/134402546/fekilid.pdfIn PDF document text
    • https://povutepumik.weebly.com/uploads/1/3/2/7/132741486/mudusizuzavogukutoze.pdfIn PDF document text
    • https://jumufewaxijakuk.weebly.com/uploads/1/3/1/3/131380308/zemuserowivule-lewofivezam-dolidikojemukek-memotulovewuz.pdfIn PDF document text
    • https://ranerenonosojib.weebly.com/uploads/1/3/1/4/131483420/359e8f0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.fontrix.comhttp://www.nhncorp.comIn PDF document text
    • http://duwewag.epizy.com/xolapomebebabowefatukuw.pdfIn PDF document text
    • http://piwufamudadavo.rf.gd/cavalcadepublishing.com_practicing_equation_balancing.pdfIn PDF document text
    • http://kakavogulogij.onlinewebshop.net/kundalini_yoga_kriyas.pdfIn PDF document text
    • http://jaweratiz.atwebpages.com/bronkodilator_adalah.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00021c2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21C2C 5884 bytes
SHA-256: c2ed7e1a5891a243ec2a1c5d002199d15a10633110898bd70129e0df9d6b268e
font_01_sfnt_off0002304c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2304C 13648 bytes
SHA-256: e4df9b086c8e91b794bbc00c3e3ac1bc20961245ecbf68b54b8cb2ffd571e9ab
font_02_sfnt_off00025d6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25D6D 16060 bytes
SHA-256: 2d97eb5b8c66583654a55461b75ebc9d5954fe3bb26bfbf5761d5bfdae6bb250
font_03_sfnt_off00027201.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27201 2412 bytes
SHA-256: 7897f01951b6066b798fa7e7dba3d2fff35ed3e10055be9e0874ea450c4ac46c

Open this report in the interactive analyzer, or submit your own file for analysis.