Malicious PDF — malware analysis report

Static analysis result for SHA-256 06abbf689a311f4a…

MALICIOUS

PDF

76.2 KB Created: 2021-04-12 19:40:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: c75099444596b684d6b6d8bfe4d35f48 SHA-1: 2b4b019a2dad09aa416b38ca4744d6033ec775e2 SHA-256: 06abbf689a311f4a81d86d5cef21cb67ac2c63bcfb2dea122161c10868e62a1b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs pointing to disposable domains, characteristic of a link farm designed to redirect users to potentially harmful content. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, identifying the document as a link farm on disposable hosting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=rezar+corona+de+adviento+2020 PDF link annotation
    • http://zemegulobeka.iblogger.org/pokojikiwarap.pdfIn PDF document text
    • http://bafujoresepivi.iblogger.org/free_anatomy_for_sculptors.pdfIn PDF document text
    • https://wugovokida.weebly.com/uploads/1/3/4/3/134319073/98142b187.pdfIn PDF document text
    • http://starkrobotics.org/walmart_bcg_matrixzlkac.pdfIn PDF document text
    • http://deseputageb.iblogger.org/42733844959.pdfIn PDF document text
    • https://zupudawuliwubil.weebly.com/uploads/1/3/4/2/134265939/lomofabudiko-lapotakufi-welur.pdfIn PDF document text
    • http://coloradocustomelectric.com/hoover_proheat_pet_carpet_cleanerpllch.pdfIn PDF document text
    • http://good-production11.site/15143178497nkj9o.pdfIn PDF document text
    • http://skidki-day.site/higher_love_steve_winwood_piano_sheet_musiclv4fx.pdfIn PDF document text
    • http://new-volosi.ru/papillomavirus_research_guide_for_authors86p2t.pdfIn PDF document text
    • http://load-bcp.com/73470787417sgbr9.pdfIn PDF document text
    • http://laxetatisitu.iblogger.org/gazulofujorasagomi.pdfIn PDF document text
    • http://d-youtube.com/how_many_calories_in_a_taco_bell_steak_soft_tacoygqiu.pdfIn PDF document text
    • http://hookup682.site/dawn_of_titans_apk_hack51nb3.pdfIn PDF document text
    • http://teporad.22web.org/lezekugowere.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zoputivep.rf.gd/infinix_note_7_price_in_india_4gb_ram_128gb_rom.pdfIn PDF document text
    • https://7a579b3f-ce96-4c66-abdc-991530493d29.filesusr.com/ugd/010c6b_38fa16aab53a41c0a07ca161c01fd950.pdf?index=trueIn PDF document text
    • https://7f03322d-63d6-449b-a8c2-a80beffeb2b6.filesusr.com/ugd/2994dd_d34bd7c98d854502aceb06b78264c667.pdf?index=trueIn PDF document text
    • http://mesesoriran.epizy.com/difference_between_humoral_and_cell_mediated_immunity.pdfIn PDF document text
    • http://nivobilov.epizy.com/tuna_fishing_reports_long_island.pdfIn PDF document text
    • http://jadizugexagosor.rf.gd/16033087155.pdfIn PDF document text
    • http://nimetegukixiz.rf.gd/xezulapuvatitapevifofor.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB11 5116 bytes
SHA-256: efe23b974843b4767701e7d8531194942608aefd988b6fa1f2594e104bcbe1ab
font_01_sfnt_off0000fc98.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC98 12128 bytes
SHA-256: 8d48bddb2aeb6e6976ca23d73c7f8514883cf37e6f93ecde774fb947b6eb61f2

Open this report in the interactive analyzer, or submit your own file for analysis.