Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ca7fd47d17b1a8e…

MALICIOUS

PDF

72.0 KB Created: 2021-06-10 06:53:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 0fd6c489ac89895957a00fb3d1e9ca17 SHA-1: 333e72c0c47655185cd9545e6527b578af11bc72 SHA-256: 0ca7fd47d17b1a8ea4fa61dbb2efe25f45c9e1e9350c33a8f33d56799a04f6fa
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to disposable domains, indicating a link farm or SEO spamming operation. ClamAV and ML classifiers identified this as malicious, specifically a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded URLs suggest an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/123?utm_term=adverbs+of+frequency+exercises+pdf+with+key PDF link annotation
    • https://gikemadisasov.weebly.com/uploads/1/3/4/6/134667176/dexawidamige_pemoxoterupe_modapa.pdfIn PDF document text
    • https://zukusabaxiwig.weebly.com/uploads/1/3/4/0/134000387/xusuzisiriwaj.pdfIn PDF document text
    • https://jawonuvanez.weebly.com/uploads/1/3/6/0/136021807/6c1b3f25b8dbcf.pdfIn PDF document text
    • https://weginufakitin.weebly.com/uploads/1/3/4/8/134846544/figozorilobifisefas.pdfIn PDF document text
    • https://kubegagalinono.weebly.com/uploads/1/3/4/7/134714436/fokigikadob.pdfIn PDF document text
    • https://gipurafesab.weebly.com/uploads/1/3/1/6/131637457/4ee644d4c34e3f3.pdfIn PDF document text
    • https://jogapemufa.weebly.com/uploads/1/3/4/4/134492880/4020bc70a13.pdfIn PDF document text
    • https://rogubadivuna.weebly.com/uploads/1/3/4/3/134337887/2bc48dec8eb.pdfIn PDF document text
    • https://jufigewadekuxo.weebly.com/uploads/1/3/1/4/131406441/716d57.pdfIn PDF document text
    • https://kitowido.weebly.com/uploads/1/3/5/3/135348724/bodifule_butigafixogiva_xatolopisivukol_kofegi.pdfIn PDF document text
    • https://vimosetadasosus.weebly.com/uploads/1/3/2/7/132740377/losozodesirob.pdfIn PDF document text
    • https://leburivirabilaz.weebly.com/uploads/1/3/1/4/131453170/2292877.pdfIn PDF document text
    • https://femanutokit.weebly.com/uploads/1/3/3/9/133999532/wulavuziguguremut.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f4b7439-2b7f-468f-8f1b-81a60e990eff/barokizabawojo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45eda2bd-640c-4c55-a407-40f618cd8a3c/the_hound_of_the_baskervilles_in_bengali.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4773459-c410-4610-afa6-ea8353c1762e/30126930362.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fc2e1d2-1b06-4683-8b73-8f9501646e01/total_flow_calculation_magic_box.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce8cde78-1b0c-4702-a703-1840a61fcee8/nuvoxigubokawonani.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/180dfe56-5248-4a60-bcf7-c5f19b702301/when_to_use_binomial_and_poisson.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80109f02-acf0-4c94-87a3-b7538e307530/87714849540.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91b52a6f-78a4-40fe-9a82-8e2f63278190/75524024401.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1b91824-8981-45ae-a607-9933d4100f74/sadie_adler_red_dead_redemption_2_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b7bb2f0-0d5a-4521-93d5-2f3a824f9a94/zizarajigarisutavok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9c8f4f8-00ab-4298-bc03-4dbbf71cdd21/19262087949.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03a68ff5-33f5-4b5b-bfb7-19db5f94ceca/best_minecraft_bedwars_server_ip_address.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff9bee36-ae7f-4e39-bc49-07fbeaec1e90/how_to_kiss_nail_dip_powder.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000daa8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAA8 5644 bytes
SHA-256: 7d4d4387b9c0fed977acb30a3a9e63fd6a5f0fb3e289a5aef6bd9b9a3e6cb13e
font_01_sfnt_off0000edee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDEE 10720 bytes
SHA-256: 3a20500fa53cfb95352acc874d2912bc3dfc85b828fbdcbc949a0cb3de126f6f

Open this report in the interactive analyzer, or submit your own file for analysis.