Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f8df14bfc630ed5…

MALICIOUS

PDF

89.4 KB Created: 2021-04-14 23:37:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: a1564369ca5b9f6ee42175ebabee0f86 SHA-1: df7df8bc2b8ee635c7c72d8554fb4508b58a93e0 SHA-256: 0f8df14bfc630ed5e193eb8559ea8906b9c0e3a1940e7d22b9fa2ab13dd39698
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to potentially malicious content. The presence of a URL with a 'utm_term' parameter indicating a download lure, combined with ClamAV and ML detections, strongly indicates a phishing or malware distribution attempt. No scripts were extracted, but the structure points to a spearphishing attachment used to deliver further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=descargar+la+biblia+completa+en+audio PDF link annotation
    • https://cdn.sqhk.co/jidimupov/orjegii/uc_browser_mini_lite_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/tigoxexuda/iaHjgjj/food_wars_season_3_dub_hulu.pdfIn PDF document text
    • https://cdn.sqhk.co/gixedomawa/KLijtVF/xcom_enemy_unknown_android_cheats.pdfIn PDF document text
    • https://cdn.sqhk.co/dojatejij/wbjijh7/36938886442.pdfIn PDF document text
    • https://cdn.sqhk.co/pufuxogife/fibjgCe/apple_sync_icloud_contacts.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://92fed17e-af34-466b-b3fe-38cd9ef27699.filesusr.com/ugd/192d58_bd30c486917f4483815274d28d017448.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dazovosugev/ximipakumumarage.pdfIn PDF document text
    • https://2d130471-2a64-48ba-87cf-8f1e86c6acad.filesusr.com/ugd/9c43ec_1d1eebfde1b644198fdb429b26b2fa4a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mubemutolewe/cuentos_cortos_en_ingles_de_terror.pdfIn PDF document text
    • https://3745348a-78a0-42d7-8ff4-af2b45bf5faf.filesusr.com/ugd/02631b_217d11656c8d4a86bca8fc2feb0db9bf.pdf?index=trueIn PDF document text
    • https://e22e8d81-f41f-4d51-abb1-39b19d2d32bb.filesusr.com/ugd/96bf9d_7657ccac1de845ebbab341a68352abee.pdf?index=trueIn PDF document text
    • https://9d1e48ad-bcd7-4831-9b7b-7108443a63b6.filesusr.com/ugd/136d07_9683be2b87e84621b57464ce89001532.pdf?index=trueIn PDF document text
    • https://7043ee2c-bc2d-4d46-b82c-b0075177c1aa.filesusr.com/ugd/f862b5_0a72686cd9d74feeb283490048d5fa17.pdf?index=trueIn PDF document text
    • https://543e2b4d-9699-46d2-9656-875e860b8e63.filesusr.com/ugd/fb32d0_be067ee2848142578c7fbbc3b7fad56a.pdf?index=trueIn PDF document text
    • https://d45380bd-a93d-4ef2-b2bd-4c7806d1f6db.filesusr.com/ugd/5d2cf3_584554a6cf7c44f2952aad4be46bbe37.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1393ab6-85c5-46f3-bfa1-b9f9f9c4a8b7/822352240.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/463ba735-c4a1-480a-a5af-15802c1c9764/vanity_fair_outlet_mall_mesa_az.pdfIn PDF document text
    • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_412ff1c546324fd3a201dd3d2827c682.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4df70707-a5b8-47c0-86d1-cd0547b69363/xokoxezezabulozuxew.pdfIn PDF document text
    • https://e7ba4f66-d023-404d-a355-a5b98970f127.filesusr.com/ugd/cac9e4_b499b2f326444e9db9fbe078b229284c.pdf?index=trueIn PDF document text
    • https://fc59733d-949e-4df9-817b-fea2515c5cc7.filesusr.com/ugd/689329_50d9ef108cfe4f93a04a7a5e3151c61e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e84d6e2-f39a-453d-83cb-5ef7611475c8/oreck_commercial_xl2100rhs_bags.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7E9 5532 bytes
SHA-256: 7edada0a41d56a4a5b4c460f08f9bf1ddcb392f1876a1bdf7f234d8e3e91b795
font_01_sfnt_off00010a94.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A94 3904 bytes
SHA-256: c5f6ad7efa783ce61ccc5b5aee226b54dfd3cfa37d779c03df1b8ec64c0fa091
font_02_sfnt_off000119dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119DD 12720 bytes
SHA-256: e164e4dfe3b63ee4a7876e91b5febf677e5f5b9b2d7a39ca36fd68bc9ff47b5e
font_03_sfnt_off000142cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x142CD 16272 bytes
SHA-256: fe6ce32daf8005165560a23a9f6fa119308f3e7a0630433bf958cbc06eda4c07

Open this report in the interactive analyzer, or submit your own file for analysis.