Malicious PDF — malware analysis report

Static analysis result for SHA-256 018c2b4a9ae50345…

MALICIOUS

PDF

116.3 KB Created: 2021-03-13 17:33:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-29
MD5: 17f61d9033fa8fcdc24b778c3016047a SHA-1: 5a05c71776887338eeaa1ccd1d3daca9bf67f303 SHA-256: 018c2b4a9ae503454e41abe136fc15fd7e2fb1dbcaf5f7ddeb725ddffbd5eb2c
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a significant number of external links, many pointing to disposable hosting, indicating a link farm or SEO spamming operation. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution. While no scripts were directly extracted, the PDF structure and numerous external URLs are indicative of a malicious document, potentially a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=brew+install+homebrew+x11+xpdf PDF link annotation
    • http://wanididezaj.getenjoyment.net/wesobobonejavep.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454681/normal_603447b618d5c.pdfIn PDF document text
    • http://atelier-spb.com/fresh_start_bariatric_cookbook1fefd.pdfIn PDF document text
    • http://gasiwine.iblogger.org/vafejasizebajosodew.pdfIn PDF document text
    • http://50offit.pro/9575377977902m6g.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407795/normal_601788bfa4abb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489404/normal_60232b6a2bafa.pdfIn PDF document text
    • http://prostosite.site/winemaking_processcy200.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384632/normal_6016c56ce7395.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445866/normal_603e66143d71c.pdfIn PDF document text
    • http://kopalirigel.mypressonline.com/pexuvodakox.pdfIn PDF document text
    • http://zuluguvo.iblogger.org/20559174514.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://1b15a19f-c8c2-4d9d-8c2f-e97aa7ecfe2c.filesusr.com/ugd/eb6c48_93b4a435544d457cb12d819ea9f0b1a9.pdf?index=trueIn PDF document text
    • https://6baea7ca-81e4-4a11-8410-716433a99462.filesusr.com/ugd/764aaa_050661693f214596b534ab61d0236627.pdf?index=trueIn PDF document text
    • https://cf2e1f24-e5f1-4289-9567-3affce9c164e.filesusr.com/ugd/a4ea6c_215254252e924af3812148f9443abd6b.pdf?index=trueIn PDF document text
    • http://poteluvomak.rf.gd/25861887063.pdfIn PDF document text
    • http://zapofekeba.rf.gd/telugu_animated_video_songs.pdfIn PDF document text
    • https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_fece3bace41d4a459c545310a4cca7b0.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC3A 6744 bytes
SHA-256: ffeb89eaad713c9717385028f79c9757067aafb2c2382ea8cbab0e6efe35a425
font_01_sfnt_off00010cf2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CF2 35440 bytes
SHA-256: 8f3dd68650cd861c66eab759c4b1c53bdd65cb7ea1a4ef87d2a5e516e84de8b9
font_02_sfnt_off00016f17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16F17 5680 bytes
SHA-256: bcb126e3c5fa6df868b0b972e2101c7ba5984195e2f4515e93ba9a16088918a7
font_03_sfnt_off00018255.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18255 12492 bytes
SHA-256: 11510eea103c4914ab239a9a7526efe6979ed706303be8f8d72924d0173aa5fc
font_04_sfnt_off0001ab32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AB32 16204 bytes
SHA-256: c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449

Open this report in the interactive analyzer, or submit your own file for analysis.