Malicious PDF — malware analysis report

Static analysis result for SHA-256 1986fca91c3ffce2…

MALICIOUS

PDF

72.1 KB Created: 2021-06-14 03:11:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: d263d48af445a0398ecbd155e06687a8 SHA-1: aa93a5c57500d99ce4612c126ddbe1a7b2dd0700 SHA-256: 1986fca91c3ffce2b463d361dcfd2df0417d6344dfc75a526a76e961bdc08255
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous embedded URLs, many of which are part of a link farm strategy, suggesting an attempt to redirect users to malicious sites. The presence of 'utm_term' parameters in URLs further supports a phishing or spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/pbw?utm_term=valmiki+ramayana+tamil PDF link annotation
    • https://static.s123-cdn-static-d.com/uploads/4384484/normal_60b77e5c53384.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479212/normal_6008d66689fad.pdfIn PDF document text
    • https://kafowuvipuv.weebly.com/uploads/1/3/4/3/134337110/pojirivefaxi-xovoxofe-jikapasufuja-pisidawuv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409619/normal_605a1ded10c14.pdfIn PDF document text
    • https://patelevikukel.weebly.com/uploads/1/3/4/6/134665122/putuzedoletamaz-janupivuregu-bonud-lejitisotitab.pdfIn PDF document text
    • https://kurakozizuvev.weebly.com/uploads/1/3/2/6/132681999/tubedanawul.pdfIn PDF document text
    • https://xidelora.weebly.com/uploads/1/3/5/2/135296398/baxopurijowetumo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469349/normal_600ba56152761.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419847/normal_5fd817e56264c.pdfIn PDF document text
    • https://runuxufugax.weebly.com/uploads/1/3/0/9/130969308/a8ee1fef9a1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kiduvipiza.pbworks.com/f/poxatuku.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/489fd2ce-6b22-4372-b43c-3f8d331bfc33/how_to_prepare_for_cogat.pdfIn PDF document text
    • http://jebodigezev.pbworks.com/w/file/fetch/145269831/donato.pdfIn PDF document text
    • http://beratirupo.pbworks.com/f/jumuwotegotawurekutedod.pdfIn PDF document text
    • http://zexowisam.pbworks.com/w/file/fetch/145275447/7008820962.pdfIn PDF document text
    • http://kedajawi.pbworks.com/f/13477238755.pdfIn PDF document text
    • http://japakekuwita.pbworks.com/w/file/fetch/144990396/pubg_song_download_mp3_tamil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/22895095-e95a-4998-b770-d84c34f4404f/wojisuvunegomazu.pdfIn PDF document text
    • http://zexarefab.pbworks.com/w/file/fetch/145157286/aim_trainer_call_of_duty.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88714a49-6daa-4a26-a3e9-a053101694be/dudimi.pdfIn PDF document text
    • http://sazupamufode.pbworks.com/w/file/fetch/144447495/kajil.pdfIn PDF document text
    • http://funasazixi.pbworks.com/f/rigekilapug.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dddf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDDF 4784 bytes
SHA-256: 740d6bdfc2ebb9cdca9c851ca6c3b3a94e1933b7aba962115b62d10cf5c2c7f7
font_01_sfnt_off0000ee18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE18 11688 bytes
SHA-256: 9d6330832f37e5bc3849b8c0d5629440e46c4d45c2b271f317ca59c8130812a0

Open this report in the interactive analyzer, or submit your own file for analysis.