Malicious PDF — malware analysis report

Static analysis result for SHA-256 04b140d81b7022bc…

MALICIOUS

PDF

67.9 KB Created: 2021-03-23 05:10:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 86cab5dddcd17d8f284904d79bedee18 SHA-1: e1cb29b86ae80c6aff9e9bd916d246c8958c7e2d SHA-256: 04b140d81b7022bc284ddedc9b9432ece9a5c71bb44e1324cb166ac0f136fbbd
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are likely part of a link farm designed to manipulate search engine results. One of the primary URLs, 'https://seumenha.ru/award?keyword=vejiga+neurog%25C3%25A9nica+en+ni%25C3%25B1os+pdf', is flagged as suspicious. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0', indicating a phishing or trojanized document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8336

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=vejiga+neurog%25C3%25A9nica+en+ni%25C3%25B1os+pdf PDF link annotation
    • https://cdn.sqhk.co/wakewafo/hyzOhgI/space_per_chicks.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387226/normal_604894ce45ab9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383801/normal_603e98e244b37.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406223/normal_5fd628d05e75f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446500/normal_5ffbd95202e35.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464315/normal_5ff7cf5cbb470.pdfIn PDF document text
    • https://cdn.sqhk.co/wabasenenem/bJR2EiU/29031317823.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402718/normal_60546629dfb39.pdfIn PDF document text
    • https://cdn.sqhk.co/gogojelawov/ghexPYz/kiwimagamenepopuvop.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c424fae-a942-4e5a-b818-e87973fca3ed/why_we_need_function_pointer_in_c.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e25476c-3de1-4bb0-b0bc-a59251cc89a3/pujalofuwa.pdfIn PDF document text
    • https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_88f040717de1452b9b5eccf7b60bc34d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/baf104fb-d22c-4b91-9b1e-a0af5e64a443/petsafe_wireless_pet_containment_system_pif-300_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc7eea17-8f69-4dc6-af1e-ffc01fafe223/87323626079.pdfIn PDF document text
    • https://aed0ee3a-d217-4696-a563-de9ff15d6c37.filesusr.com/ugd/f80e3f_0a3ef9b664b941f5950a916ac6517514.pdf?index=trueIn PDF document text
    • https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_1b51d2b7209c4b5ea661731fdee64e42.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3da039e9-1282-41ba-b390-a43917637a19/41076447617.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC61 5684 bytes
SHA-256: e3afc9be336d974c81fac36cc38c3df06f844838acf96040f6f0e2f2ff202078