Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a4d6a35f7ac9436…

MALICIOUS

PDF

78.1 KB Created: 2021-03-31 12:48:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 953bcfac5ad19fe006c6299c069202eb SHA-1: 75456045fc7daa32d4dc9fcbaeb4dae2b6320722 SHA-256: 1a4d6a35f7ac94364a5f3256790ac2f5f64dd5f119ed3452cbff431bcbf2884f
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a LOLBin command-execution lure. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=ketosis+in+cattle+merck+manual PDF link annotation
    • https://cdn.sqhk.co/jorimalid/gg2yJgc/dialga_best_moveset_pokemon_sword.pdfIn PDF document text
    • http://fesotisifofil.mygamesonline.org/first_grade_math_standards_cheat_sheet.pdfIn PDF document text
    • http://lopixerirerenex.mywebcommunity.org/african_swine_fever_virus_real_time_pcr.pdfIn PDF document text
    • http://xamojofar.22web.org/4739758385.pdfIn PDF document text
    • https://cdn.sqhk.co/puxolika/CdgcgeB/61739904616.pdfIn PDF document text
    • http://tiledevaw.22web.org/wafutetulega.pdfIn PDF document text
    • http://kadanijojabuf.mywebcommunity.org/windows_powershell_ise_free_download.pdfIn PDF document text
    • https://cdn.sqhk.co/vetukalujir/570Grgj/7475711983.pdfIn PDF document text
    • http://fafikup.scienceontheweb.net/gojirenab.pdfIn macro / runtime command snippet
    • http://fuvagezilavez.mygamesonline.org/ravapivedaxesaxixadoda.pdfIn PDF document text
    • https://cdn.sqhk.co/vetukalIn macro / runtime command snippet
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://12f7643e-9106-4823-89c2-0bdaecd1bc22.filesusr.com/ugd/1f6d71_f8f2f19d0124470da9408171cf14b1d8.pdf?index=trueIn PDF document text
    • http://jabafujadopus.rf.gd/definition_of_integrated_science.pdfIn PDF document text
    • http://jupanifoz.epizy.com/walker_buehler_injury_report.pdfIn PDF document text
    • http://lorenivi.rf.gd/free_math_worksheets_grade_7_geometry.pdfIn PDF document text
    • https://d45380bd-a93d-4ef2-b2bd-4c7806d1f6db.filesusr.com/ugd/5d2cf3_89817f441782458a96daa4a437f10f4d.pdf?index=trueIn PDF document text
    • http://guwavamo.rf.gd/22211115159.pdfIn PDF document text
    • https://4fe85328-8dbf-40e9-afa8-2c8d6ff8a9c8.filesusr.com/ugd/9c0842_f63a0202cc0749deb54c8f17d22283b3.pdf?index=trueIn PDF document text
    • https://c4cd0dbc-23d7-4f11-b65f-2561cec8abe5.filesusr.com/ugd/516793_d11f45813fd7403d9f3a3c22dddce0bb.pdf?index=trueIn PDF document text
    • http://nexovototato.epizy.com/25096561617.pdfIn PDF document text
    • http://wajavuwexoda.epizy.com/honeywell_home_rpls740b1008_econoswitch_7-day_programmable_light_switch_timer_white_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f236.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF236 4976 bytes
SHA-256: 99535896cf6dc6c7ff2185270f457518e7850ae9df751eca91d8395d5b8b088a
font_01_sfnt_off0001030c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1030C 11876 bytes
SHA-256: 5ad183557e0db8d23c63409bcf3cc6bc974fcb810c68b7f94c15ccb40f2f7d26

Open this report in the interactive analyzer, or submit your own file for analysis.