Malicious PDF — malware analysis report

Static analysis result for SHA-256 08c37a1298b48ac1…

MALICIOUS

PDF

96.4 KB Created: 2021-04-03 05:50:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: eb40cfe0673139e20885216c1d419e95 SHA-1: 2d48e17b3849ea524007bf666c6ad619b69d840c SHA-256: 08c37a1298b48ac1d5b14aa85e7d1bb31b31bfee2f20c0338532b5060d184819
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to malicious sites. The primary URL identified is 'https://xezojetit.ru/strik?utm_term=lochinvar+knight+xl+service+manual', which is likely part of a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=lochinvar+knight+xl+service+manual PDF link annotation
    • https://kajugolake.weebly.com/uploads/1/3/0/9/130969904/rabotipu.pdfIn PDF document text
    • https://cdn.sqhk.co/nujusowidom/8wtiOji/fozabosegir.pdfIn PDF document text
    • https://gawudizilox.weebly.com/uploads/1/3/5/3/135300959/bexevakusowun-dexelodemadif-joxekijifeponaf-bonese.pdfIn PDF document text
    • https://tazuwadafif.weebly.com/uploads/1/3/4/8/134857375/4806499.pdfIn PDF document text
    • https://xekukagakodepa.weebly.com/uploads/1/3/3/9/133999272/dofoxepat-robaner-mirapulovewozun-busagak.pdfIn PDF document text
    • https://cdn.sqhk.co/pananumujo/GXKggjb/galer.pdfIn PDF document text
    • https://fixivure.weebly.com/uploads/1/3/4/8/134888316/5724322.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491169/normal_60045a9a4c38b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482863/normal_60291d56c049a.pdfIn PDF document text
    • https://cdn.sqhk.co/letarezetap/BgfBgji/jidetur.pdfIn PDF document text
    • https://cdn.sqhk.co/dofexoxev/FIhhhjg/used_cars_near_me_under_2000_craigslist.pdfIn PDF document text
    • https://lipopujowojirew.weebly.com/uploads/1/3/1/4/131408954/7f28e4f2.pdfIn PDF document text
    • https://dodesagetulisuv.weebly.com/uploads/1/3/4/9/134902864/1d7b3aedabfb7a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://6f12065f-c45d-410c-b048-6ec23fb2b810.filesusr.com/ugd/02ccf7_9ce09a9c92ae4a04b0784866626a973f.pdf?index=trueIn PDF document text
    • https://a35b4eae-300a-44a5-b982-8d633984e519.filesusr.com/ugd/19735e_723e8bade0c64497b4ebef1a9d2a7e06.pdf?index=trueIn PDF document text
    • https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_87e98b6e2203432db455b222529a20ba.pdf?index=trueIn PDF document text
    • https://af1bea64-f5cd-41c2-a7c1-97f21c1aa057.filesusr.com/ugd/592671_6bc5577ebcdd420f838860ff4c29be53.pdf?index=trueIn PDF document text
    • https://c2c662fa-00ac-4c69-bf5d-04da7d6c99e2.filesusr.com/ugd/9b33c5_f0fbdfb53fd64798bdf1594b23a3127c.pdf?index=trueIn PDF document text
    • https://05282879-aed3-4f16-ac14-d534add4d4bd.filesusr.com/ugd/0f8b7c_f58a22c04018478a9472f7992f1ef284.pdf?index=trueIn PDF document text
    • https://a4346b84-4611-49ab-b113-80c9188ca613.filesusr.com/ugd/078c79_a0de0a3d627c4d9798cc6abb2e467ec7.pdf?index=trueIn PDF document text
    • https://bb74f61c-7045-47bf-9a7e-968101ee373e.filesusr.com/ugd/81ef4b_62d97b2539bf46b895c2e46b06a00e77.pdf?index=trueIn PDF document text
    • https://95a83a18-022f-4aa5-9dc2-588eac4c5c4a.filesusr.com/ugd/ccb6ab_eff06c8214344d6b801174f71d0ab43d.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012361.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12361 5228 bytes
SHA-256: df5456ddf4d5cd028fb864af9f61f200d00c36136ec7a0d4ed6be1708892abb2
font_01_sfnt_off000134f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134F9 2048 bytes
SHA-256: 2f430097b0e4e500d7174239800a4340685bc181b3707dff1089dac455c017f5
font_02_sfnt_off00013dd9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13DD9 11172 bytes
SHA-256: f0cd4e9d33193009a46c0a1062d94a243b649befce113e2adce8fe46456a4157
font_03_sfnt_off000163c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x163C4 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.