Malicious PDF — malware analysis report

Static analysis result for SHA-256 056476a67b6bf036…

MALICIOUS

PDF

75.1 KB Created: 2021-03-28 00:43:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ff39b1c65c14ac6cc2f0b7683d6b284e SHA-1: 7367abf33163cdf9e98426c3f320643ced36650b SHA-256: 056476a67b6bf0368a019519e0f0d92069e5bab25f83324e7665d599cdca5da8
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to disposable hosting, indicating a link farm or phishing attempt. The ClamAV detection and ML classifier strongly suggest malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=babul+movie+video+song++full+hd
    • https://cdn.sqhk.co/gepabafi/chejgge/cara_cheat_game_magic_school_story.pdf
    • https://static.s123-cdn-static.com/uploads/4472186/normal_5ff2f076548d5.pdf
    • https://tuxitusonodedin.weebly.com/uploads/1/3/0/8/130873989/6a3ec3d2.pdf
    • https://static.s123-cdn-static.com/uploads/4479902/normal_5ff37406e1974.pdf
    • https://cdn-cms.f-static.net/uploads/4368504/normal_60111f96030e5.pdf
    • https://cdn.sqhk.co/nogawevorus/kHoYDib/iphone_x_fluid_live_wallpaper_for_android.pdf
    • https://dokegofixak.weebly.com/uploads/1/3/0/8/130873830/muwilerisavowu.pdf
    • https://cdn.sqhk.co/gukokefa/MNggEii/42988735461.pdf
    • https://cdn.sqhk.co/surodamiz/AIibjjg/91701215855.pdf
    • https://viriparerari.weebly.com/uploads/1/3/5/9/135978168/zikuridezaz-sexodufetotit-rimedemanujuve-natipixafun.pdf
    • https://mulodunewumil.weebly.com/uploads/1/3/4/3/134314444/93251d.pdf
    • https://lokizidaputanex.weebly.com/uploads/1/3/2/6/132680869/damilexe.pdf
    • https://mibofadap.weebly.com/uploads/1/3/1/6/131637701/rarozavariz-dulejalujop-zebesigoba.pdf
    • https://wegakerovosa.weebly.com/uploads/1/3/0/8/130873826/9036371.pdf
    • https://cdn.sqhk.co/besimiwi/PjJjipX/paxogogowugerasubufur.pdf
    • https://xonuguzuv.weebly.com/uploads/1/3/1/3/131382030/e4f161973e7cd.pdf
    • https://cdn-cms.f-static.net/uploads/4476766/normal_6042c38487133.pdf
    • https://fefodenajefive.weebly.com/uploads/1/3/1/4/131437461/35489c67a63458.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0c2a99dd-71fd-4a0d-b96f-672cfa785c21.filesusr.com/ugd/515c54_c53f56311fd143db92c78f44a39b97b3.pdf?index=true
    • https://0e733887-fd72-4d21-8b10-0a39cafbc931.filesusr.com/ugd/1e4d10_b539505bd65b4955913f48375b7115ec.pdf?index=true
    • https://64e18f06-8a0e-4dc1-8427-9dd81b4bff36.filesusr.com/ugd/baa514_272a4394e7b54188bf2494126b7a389d.pdf?index=true
    • https://39c1d623-eccb-4af0-a86a-15328a2d61f9.filesusr.com/ugd/3cb6cb_8592ecec520a49a5a6137e7249dfa15e.pdf?index=true
    • https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_64d46811e2a244f984d362f098bdecc6.pdf?index=true
    • https://05f6fcc2-a4c7-4d5b-b58c-97b640a93f4d.filesusr.com/ugd/74147a_73d9bca128cf44ce8d66619b872bf758.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e720.bin
f6436449561229a625e966baff8f486d3163bdd1d1df259239d613effb674a42		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE720 5476 bytes
font_01_sfnt_off0000f9a8.bin
223940bcb99c8fbecd1c2746b91bae8c2b02aaf9f1b0748c294aee2dfcf5c52d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9A8 10828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.