Malicious PDF — malware analysis report

Static analysis result for SHA-256 17e246708f01328c…

MALICIOUS

PDF

92.4 KB Created: 2021-02-13 18:33:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 0408ecb3eb170d66db5bd379eb125d8e SHA-1: df7fcc2fe373e3db66dec5623456976d35a51983 SHA-256: 17e246708f01328c7c16381b97f2d9678c30dca4958b66cc0819ed698d882453
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm designed to redirect users to potentially malicious content. The presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' strongly indicate an attempt to manipulate search results or distribute malware through these external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=oakland+development+projects+2019 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4366397/normal_5ff8284f0e1a7.pdfIn PDF document text
    • https://zusonuxegaza.weebly.com/uploads/1/3/1/4/131437774/60792a2a445cf9f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384029/normal_5fff489ea196e.pdfIn PDF document text
    • https://cdn.sqhk.co/tivuzofep/3njcibT/samsung_print_service_plugin_android.pdfIn PDF document text
    • https://xaredoluvowa.weebly.com/uploads/1/3/1/8/131871785/133159c7b079.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483586/normal_6003986c49c98.pdfIn PDF document text
    • https://seruvukajobal.weebly.com/uploads/1/3/4/4/134479042/7199765.pdfIn PDF document text
    • https://cdn.sqhk.co/numexerab/6jidihY/stickman_school_escape_2.pdfIn PDF document text
    • https://cdn.sqhk.co/penunotati/hh5gjXh/disneyland_paris_hotel_new_york_refurbishment.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382187/normal_601272cd7813a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481515/normal_5fd5f6f64d9c4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384468/normal_601328c858cd2.pdfIn PDF document text
    • https://tubidurifubadas.weebly.com/uploads/1/3/4/8/134885002/7436ec113.pdfIn PDF document text
    • https://cdn.sqhk.co/tajixixejafi/hDpTTic/9244273469.pdfIn PDF document text
    • https://cdn.sqhk.co/busosuwik/jagd8hc/podiv.pdfIn PDF document text
    • https://cdn.sqhk.co/fowurona/q9jchbe/57755828016.pdfIn PDF document text
    • https://cdn.sqhk.co/vexorikodo/cib0hh8/dash_mini_pumpkin_waffle_maker_recipes.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/resixexi/vutozanuparunofum.pdfIn PDF document text
    • https://s3.amazonaws.com/rogugagatuf/react_native_navigation_example_android.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f06e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF06E 3196 bytes
SHA-256: 58d50d33d611256956a1b7b21747825411834050c700845273ad996b1218c646
font_01_sfnt_off0000fbc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBC7 5668 bytes
SHA-256: 86ba0a58c69d54c79ed3dae92743d3bbbd02bf18555b91e776d18e6a8da20147
font_02_sfnt_off00010f04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F04 2108 bytes
SHA-256: 1d739be46a300e0470098b03cb3525ce218fda25c712b9663aaff7a7ecef4354
font_03_sfnt_off000118d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118D2 11132 bytes
SHA-256: c01fdca367392ac932418844304c2e724bd2c15070ce1b3f1df6b130efe08002
font_04_sfnt_off00013e9a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13E9A 16508 bytes
SHA-256: 792fca4811b09df2f7f5fb0c3b641417dae472ef6dc5b547f93bd05ae5a15d47
font_05_sfnt_off000154f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154F0 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.