Malicious PDF — malware analysis report

Static analysis result for SHA-256 048052effde6c05a…

MALICIOUS

PDF

72.5 KB Created: 2021-03-20 10:51:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 741fbf4113a35967b71b646844a48d51 SHA-1: d0e5e1e365bca560dea6fe91ddf517b9741dc9c8 SHA-256: 048052effde6c05ab8da902f38225bf1aefbb15df1f1d4223d7b8d3e9189fe22
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to potentially harmful content. The document body, though partially corrupted, contains text related to "Canada application forms and guides", which serves as a lure to encourage users to click on the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=canada+application+forms+and+guides PDF link annotation
    • http://wumewil.sportsontheweb.net/the_history_of_south_america_every_year.pdfIn PDF document text
    • http://silekutum.medianewsonline.com/gexederapoxisik.pdfIn PDF document text
    • http://tanivikovome.sportsontheweb.net/beatriz_sarlo_borges.pdfIn PDF document text
    • http://napowojeba.medianewsonline.com/ielts_reading_techniques_and_tips.pdfIn PDF document text
    • http://kazimibi.getenjoyment.net/is_motorola_sbg6580_dual_band.pdfIn PDF document text
    • http://kevakigev.medianewsonline.com/adjective_worksheets_with_answer_key.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6fd4412c-3e6e-4f21-a9af-8137ffc6c0d9.filesusr.com/ugd/03469c_956091ccfaf444cba012f44f42cb5f62.pdf?index=trueIn PDF document text
    • https://d0570615-6cc6-4b78-9a9c-590639bc525b.filesusr.com/ugd/30850e_a4373b4564164215b8c611d18265265a.pdf?index=trueIn PDF document text
    • https://0f926834-650c-4d5a-b53c-ad60ae412ccc.filesusr.com/ugd/6a44d8_c6739ec69c7d40bfbc9d554fe7633451.pdf?index=trueIn PDF document text
    • https://afa032df-bfad-47da-a9c8-c79260182993.filesusr.com/ugd/6f9b04_ef61f36b5cc04ce28abb7ec1bd33cfee.pdf?index=trueIn PDF document text
    • https://4a5bfc55-71df-4474-8f3e-9f6aca65c64b.filesusr.com/ugd/29b6ce_fc267196778244c4adaba339874e8192.pdf?index=trueIn PDF document text
    • https://3c199e1c-ff83-4553-a351-db1e9419129c.filesusr.com/ugd/424a74_1a087b773c2e4cf38430ca7d6c34f962.pdf?index=trueIn PDF document text
    • http://davinawoguzag.atwebpages.com/star_wars_ffg_unlimited_power.pdfIn PDF document text
    • https://fc060a1e-8c1d-4b7d-bafd-75f79d4c6355.filesusr.com/ugd/c0a468_562e1db8fc7b49089a860dbd2bb33553.pdf?index=trueIn PDF document text
    • https://113c517c-d7b0-4b36-99d7-6722bcb7ef36.filesusr.com/ugd/8e66a5_4e103f4d19f144d0b4a7dfef3b5c7dce.pdf?index=trueIn PDF document text
    • https://e33362eb-94ba-4427-a888-6f4863169a18.filesusr.com/ugd/36ce96_2c51be7104d649a99a7c32312b04d090.pdf?index=trueIn PDF document text
    • http://tefetuzuzip.myartsonline.com/descargar_google_traductor_ingles_espaol_espaol_ingles_gratis.pdfIn PDF document text
    • https://8d928d4c-4e32-4dc6-8093-d383c90b3cca.filesusr.com/ugd/b5d49c_3f2d71553f9844f4a19a15a7879247a6.pdf?index=trueIn PDF document text
    • https://b634734f-67aa-4edc-9b69-dcf7610e4690.filesusr.com/ugd/c86859_5ae1c1e284d4449ba39ec01b8bcbacea.pdf?index=trueIn PDF document text
    • https://eed7fa7e-4f31-4ba6-8269-e73f07ac74c5.filesusr.com/ugd/93374d_5f7f55f64fde4ffa9b73899e97fceb79.pdf?index=trueIn PDF document text
    • https://19d8af67-ac20-4a7c-8ffd-69be953788a8.filesusr.com/ugd/578741_e5b51f8c2b3d489cb612fb987e03a20f.pdf?index=trueIn PDF document text
    • https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_3fc7d76a57304e7aa004beb3a8dd7e32.pdf?index=trueIn PDF document text
    • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_b3bf81299fca44079d1b32612df44f78.pdf?index=trueIn PDF document text
    • https://78bdfa25-736e-4945-a764-db21511aacb9.filesusr.com/ugd/9bd82e_74ebde9ba6514ae7b67cc5c83fce3813.pdf?index=trueIn PDF document text
    • https://8f1c0ae7-1ba6-4c51-a623-4d29f5e3aebb.filesusr.com/ugd/c1615c_7eaae7bcbfbc4dfbb94aab3cf11b51eb.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de23.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE23 5380 bytes
SHA-256: efc7c94068175c5a17ea2c9ddafd77868a0c7f9691384086f25b5878fd17e9a5
font_01_sfnt_off0000f056.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF056 10552 bytes
SHA-256: c8052fd336cb43ad11cc9dbc6d7a44af81355e4319555012e1e70abd9d4a76ec

Open this report in the interactive analyzer, or submit your own file for analysis.