Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe29f9a82854ad87…

MALICIOUS

PDF

126.6 KB Created: 2021-04-26 12:07:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e18ba3263d99fe8f32d4897619ec2dde SHA-1: 9ed4686834813abf2d13cec469da9fe8798f3445 SHA-256: fe29f9a82854ad879c01eeced50833fe08804e97ca94c1c6e273095c562003e3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains a large number of embedded URLs, many pointing to disposable domains, indicating a link farm designed to redirect users to potentially harmful content. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=letra+y+acordes+libre+el+espiritu+de+dios
    • http://copyright-infringement.business/badanuvukuxijunosutokarikwh9u.pdf
    • https://static.s123-cdn-static.com/uploads/4426942/normal_600732c183408.pdf
    • http://getsol.xyz/xugagipopkuqs1.pdf
    • https://static.s123-cdn-static.com/uploads/4367947/normal_60073486bfbde.pdf
    • http://mowuvivof.22web.org/97781748213.pdf
    • https://cdn.sqhk.co/dodiniwotud/4kDzRii/31868211447.pdf
    • http://salea.site/16914301426sjlh0.pdf
    • http://1cats.space/the_big_book_of_kombucha_epubc8jc6.pdf
    • https://cdn.sqhk.co/mujekesire/7aWggaS/10712761734.pdf
    • https://cdn.sqhk.co/fexilejedit/Shb4Txp/litopojujasomibikus.pdf
    • http://hotita.space/block_format_business_letter_samplejb6s9.pdf
    • http://vladport.ru/87295028630y7z3d.pdf
    • http://helpcenter.business/lejogikqkia4.pdf
    • https://static.s123-cdn-static.com/uploads/4471096/normal_5ff4c73fc3f4e.pdf
    • https://cdn-cms.f-static.net/uploads/4527042/normal_60486aff2ded4.pdf
    • http://marketeuro.pro/amplificador_marshall_mg30cfx_precio3o8ig.pdf
    • https://cdn.sqhk.co/wevamerazo/ghKjjhh/create_your_own_unicorn_headband.pdf
    • http://coupons2020.info/the_game_changers_film_online_subtitrat_in_romanaxqm1w.pdf
    • https://cdn-cms.f-static.net/uploads/4461786/normal_6044ff563d60d.pdf
    • http://xinorigevidemo.iblogger.org/toxins_in_food.pdf
    • https://cdn.sqhk.co/kajutizikodu/cgehjjf/steam_link_hardware_specifications.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/ropuba/is_panda_express_really_bad_for_you.pdf
    • https://s3.amazonaws.com/tesasubawalozan/47154765215.pdf
    • https://s3.amazonaws.com/xaliwalufoguni/sapugetuvoretu.pdf
    • http://kusogit.rf.gd/angels_in_america_play_script.pdf
    • http://moseligukunevuz.epizy.com/daxovabedewipulinugame.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001b0ca.bin
b95fa1dc1269dc9e1d30f788067489c82e55817815e45a3db22e436ac9dcc3c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B0CA 5248 bytes
font_01_sfnt_off0001c2b3.bin
347d4b0528270468064ea6af5c4b940698c6a4e3f5747b6d46857ced8681524d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C2B3 12432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.