Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdac6516acabf1b5…

MALICIOUS

PDF

129.8 KB Created: 2021-04-12 13:20:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: b18ca803752a10cfd0cb75d1d92f41f4 SHA-1: 862000c052d1d9b9a8e9435277371eb4bb9d3808 SHA-256: fdac6516acabf1b5075f76a62674235f7049650823e30e75ff8b45d577bba98a
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan variant. Heuristics indicate it functions as a link farm, directing users to multiple external domains, some of which are associated with disposable hosting. While no scripts were extracted, the PDF structure and embedded URLs suggest an attempt to redirect users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.guninetwork.org/system/files/webform/heirri_proposals/35039450578.pdf In PDF document text
    • http://www.muttypawsacademy.com/sites/default/files/webform/vaccines/nojezajewi.pdfIn PDF document text
    • http://oaklandchildcare.org/sites/default/files/webform/34869944823.pdfIn PDF document text
    • https://www.newburghgroup.com/sites/default/files/webform/resumes/falaburisidibiwad.pdfIn PDF document text
    • https://www.dgs-interparts.be/sites/default/files/64751185730.pdfIn PDF document text
    • https://www.visitsavannah.com/sites/default/files/webform/59391310887.pdfIn PDF document text
    • http://portal-mysigma.com/system/files/student-proof/woximinel.pdfIn PDF document text
    • https://www.mainephilanthropy.org/sites/default/files/ziladiweropisikiforab.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=lady+or+the+tiger+activitiesPDF link annotation
    • https://campusrec.princeton.edu/system/files/webform/18758627140.pdfIn PDF document text
    • https://drones.princeton.edu/system/files/webform/zifogisabivaloxigisosobu.pdfIn PDF document text
    • https://minorsoncampus.princeton.edu/system/files/webform/jawugu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017382.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17382 14336 bytes
SHA-256: 43554ad5d9c70dd0e5d889e3c23c550b640308df45105a67ccbc119b52670779
font_01_sfnt_off0001a378.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A378 5272 bytes
SHA-256: f0cc7b8f0e5385f5a0cc25b85897a8e0f88efaf20007284ce38da59dd56e23f0
font_02_sfnt_off0001b56c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B56C 5812 bytes
SHA-256: ac46ee95c0fa6e3a7d391a0d808f02bfdea0c489ddbd44b21f539b2961f851a0
font_03_sfnt_off0001c405.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C405 13056 bytes
SHA-256: fc39931b655ab77d6649a1bc8a54006c356642a3b8d08d3f4e0508472e4d5134
font_04_sfnt_off0001ef9a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EF9A 2792 bytes
SHA-256: 0ae6aaa7f9ff25c9f8375576a0001b294d82a321c4f24c342a5eb47a6f7cea8d

Open this report in the interactive analyzer, or submit your own file for analysis.