Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e8adc13b1da6485…

MALICIOUS

PDF

75.4 KB Created: 2021-05-04 03:46:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: d109c11d910b46a440213cad5870d915 SHA-1: 7ee69b47506e02ed007675569c6e47c55bef5885 SHA-256: 1e8adc13b1da64858dcf88eb9554b4878b11078687e08a2a46da185df5fb0644
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many hosted on disposable domains, indicative of a link farm or phishing operation. The ClamAV detection and ML classifier strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and numerous external URIs point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9047

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=at+what+age+is+the+human+male+brain+fully+developed PDF link annotation
    • https://cdn.sqhk.co/lunilageruvu/bhfgGhg/10391738843.pdfIn PDF document text
    • http://in-arenas.com/26717595584emhml.pdfIn PDF document text
    • http://wodekenizowa.getenjoyment.net/troy-bilt_9_in._140cc_gas_lawn_edger_trencher_25b-55ma766.pdfIn PDF document text
    • http://zokupez.mygamesonline.org/oracle_autonomous_database.pdfIn PDF document text
    • https://cdn.sqhk.co/nifodotiriru/5A2DEgh/bidyalay_parent_teacher_communication_school_application_timeline.pdfIn PDF document text
    • https://cdn.sqhk.co/goluxewimabu/3hjKijY/paypal_customer_service_telephone_number_uk.pdfIn PDF document text
    • https://cdn.sqhk.co/kunimanujage/6VihjiV/xitizad.pdfIn PDF document text
    • https://cdn.sqhk.co/jirowolad/ififjau/vlc_media_player_android_app_free.pdfIn PDF document text
    • http://arm-watch3.club/2463599089219xb9.pdfIn PDF document text
    • http://bettyloustintruckbbq.com/realidades_2_capitulo_6a-_4_answers5wgnv.pdfIn PDF document text
    • https://cdn.sqhk.co/kikepedu/gehe03t/juzuzekazatonum.pdfIn PDF document text
    • https://cdn.sqhk.co/gejupajo/rqmZUhe/74478863558.pdfIn PDF document text
    • http://kekewawoxugar.sportsontheweb.net/repemimavozitu.pdfIn PDF document text
    • https://cdn.sqhk.co/gufezitaxato/gdPCjgJ/37137603256.pdfIn PDF document text
    • https://cdn.sqhk.co/sategexarom/ebjgib5/babikelagalanebelupikofus.pdfIn PDF document text
    • http://es50off.pro/pobaxemefozukiralopitiburkvkt1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://959e49da-b405-4961-97d4-5c1bb2e9a628.filesusr.com/ugd/ab0441_32323723b2c8418cafc13f64d202bc15.pdf?index=trueIn PDF document text
    • https://667abc8f-92ca-45d9-bc9d-789c80a68858.filesusr.com/ugd/dcd78f_a127fec7981247209012e30bd4df743b.pdf?index=trueIn PDF document text
    • http://gisaxuzarufol.epizy.com/southern_and_northern_hybridization.pdfIn PDF document text
    • http://fiwazabon.rf.gd/99852049211.pdfIn PDF document text
    • http://sewegijod.rf.gd/90452591301.pdfIn PDF document text
    • http://lejiletuvasipib.onlinewebshop.net/types_of_antidotes.pdfIn PDF document text
    • http://wuwedilejom.myartsonline.com/xukobepotuvazipa.pdfIn PDF document text
    • https://ce3a146a-d504-4efb-981c-4593fb85d965.filesusr.com/ugd/5b5da7_34f165a70e7e401ea634e598b44af432.pdf?index=trueIn PDF document text
    • https://33b7cf8b-1cb2-46d9-9063-17e97cba5e80.filesusr.com/ugd/9edd50_cc578e8cfd494343b288c3d06e4af4a7.pdf?index=trueIn PDF document text
    • http://natexaz.rf.gd/15653927813.pdfIn PDF document text
    • https://68358877-4ee6-4e53-94f7-4bd9665c1f53.filesusr.com/ugd/3bbd68_15ae9af053a94edf80d4659e8221f00f.pdf?index=trueIn PDF document text
    • http://madukesizor.epizy.com/morfologi_rotifera.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B62 5840 bytes
SHA-256: 9de1e28d03a7c0ada0495f667b6e0f061aa97fadfff107452f67ad084b9843b1

Open this report in the interactive analyzer, or submit your own file for analysis.