Malicious PDF — malware analysis report

Static analysis result for SHA-256 07f1e9c7633e856d…

MALICIOUS

PDF

88.4 KB Created: 2021-03-13 20:03:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 36598c2f1e68b974d9e0986c7b1e2ffe SHA-1: 91ba1424f374aa53da72afb8ed564d27bc18d051 SHA-256: 07f1e9c7633e856dea1dbfd137e3ae285003ce63e0cc3b5592d546d6a8da4012
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are numeric and appear to be part of an SEO link farm. The document body, though heavily obfuscated, suggests a theme related to 'Asciidoctor themes pdf', likely a lure to drive traffic to these external sites. ClamAV detection and ML classification further indicate malicious intent, possibly related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6264

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=asciidoctor+themes+pdf PDF link annotation
    • http://rawoxaxevog.mygamesonline.org/network_security_firewalls_and_vpns.pdfIn PDF document text
    • http://jabilevij.mypressonline.com/can_you_adjust_the_draw_weight_on_a_compound_bow.pdfIn PDF document text
    • https://penixosifa.weebly.com/uploads/1/3/1/4/131482878/pufiborilof.pdfIn PDF document text
    • https://cdn.sqhk.co/sudofeno/Qvf5ojg/likigurevefa.pdfIn PDF document text
    • https://pewidujatiw.weebly.com/uploads/1/3/1/3/131381722/1481529.pdfIn PDF document text
    • https://mokakabatedi.weebly.com/uploads/1/3/5/3/135300589/fonola_xorefa.pdfIn PDF document text
    • https://biwakegexenulu.weebly.com/uploads/1/3/4/4/134437141/4629b28ccd.pdfIn PDF document text
    • http://zedateve.mypressonline.com/beats_by_dr_dre_studio_1_manual.pdfIn PDF document text
    • https://cdn.sqhk.co/terasovo/Dhajf3j/7781206866.pdfIn PDF document text
    • https://bonadamoge.weebly.com/uploads/1/3/4/0/134000068/d79b4d90bf5a99c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://napamewa.atwebpages.com/66509284712.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f94f8bbe-cd69-44fb-9667-f1a08fc01452/xunuzetifape.pdfIn PDF document text
    • https://s3.amazonaws.com/tubukeganuji/19167869428.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47ffdc12-6212-4d53-bc96-6e3cfedc83ce/59290338979.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2758255-810f-44a6-97b0-0d9027437162/folexederadipufo.pdfIn PDF document text
    • https://s3.amazonaws.com/jeworurowam/nogakakekamo.pdfIn PDF document text
    • https://s3.amazonaws.com/sobaketemu/hip_hop_dance_stunts_free.pdfIn PDF document text
    • https://s3.amazonaws.com/kujapomib/directv_remote_control_codes_for_jvc.pdfIn PDF document text
    • https://s3.amazonaws.com/pukiza/bejeweled_classic_old_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/nilafafakem/graco_snugride_30_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cba2c78a-ab95-4130-a1de-aa266dc1d1f2/83851664549.pdfIn PDF document text
    • https://s3.amazonaws.com/taguxif/como_aprender_espanhol_online_gratis.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011b79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B79 5144 bytes
SHA-256: 57881f220bc3fef8b243d7f6030173edd6b95160af6e7e76dd1901bb3be4b400
font_01_sfnt_off00012cd0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CD0 12420 bytes
SHA-256: 2a69ba71458f18bd36a32f945b4a513723ea461c97bb50f551f1472ce3546c41

Open this report in the interactive analyzer, or submit your own file for analysis.