Malicious PDF — malware analysis report

Static analysis result for SHA-256 24c16a4e864ac0cd…

MALICIOUS

PDF

81.8 KB Created: 2021-04-06 21:28:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a907a693b6fcb705474bcd78046638a1 SHA-1: cbcec879dbeea62140f4464c7b273262dded1d34 SHA-256: 24c16a4e864ac0cd782c74952a0e14e9c1ab26e564dc58b0576ca293fc20c5a2
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier also flagged this file as malicious, suggesting a phishing or trojan distribution intent. The embedded URLs point to potentially malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7708

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=aggregate+demand+and+supply+analysis+pdf
    • http://pozufopajosel.mypressonline.com/types_of_allegory.pdf
    • http://vijofudevadotar.mywebcommunity.org/bransle_de_la_torche.pdf
    • http://nesakud.mypressonline.com/besame_mucho_guitar.pdf
    • http://ronifibofizet.medianewsonline.com/ipod_classic_30gb_battery_replacement.pdf
    • http://berozabekep.sportsontheweb.net/gobavofazexedowepa.pdf
    • http://lubevos.scienceontheweb.net/75646018283.pdf
    • http://rolevuses.iblogger.org/model_3_long_range_performance_boost.pdf
    • http://nakaxovatixokew.22web.org/british_comedy_guide_quiz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ramivigemotaf.epizy.com/battlefield_5_firestorm_for_android.pdf
    • https://7f1888b6-cdab-4603-9914-1cf81a8b29aa.filesusr.com/ugd/6846fe_e4091f0ecff4438d9f5f30e82ac7593e.pdf?index=true
    • http://warodisomadux.epizy.com/zufenabubidetapanimebu.pdf
    • http://ledojiwibobuva.rf.gd/application_letter_for_work.pdf
    • https://ff06b2c9-6223-4357-b4d5-1bf3807c749f.filesusr.com/ugd/717131_a35674d8f3804340bff218ef94f27e51.pdf?index=true
    • https://55963656-6eb1-4b25-bcd5-bb835d65808b.filesusr.com/ugd/0064ae_8db34689892540c888b255f63c34af62.pdf?index=true
    • https://dc5983eb-04eb-4341-be6e-5f763cf8c8d0.filesusr.com/ugd/979c04_ec9be75cf2004a97b07a85711bc28d07.pdf?index=true
    • https://ee6bc897-aa08-459d-b6e6-b1b1d69fcba1.filesusr.com/ugd/7ba596_4e2c75dd05fb4519a7e5231f159b92cb.pdf?index=true
    • https://0face946-3507-4f1d-9804-30df5ac990e4.filesusr.com/ugd/8dfcc1_4097ba4e0f58437b988325068685d012.pdf?index=true
    • https://00eaa6b3-f026-4720-b00f-fafb40066352.filesusr.com/ugd/d498be_b14f3f1207664c0fa0c7f8832e254e85.pdf?index=true
    • https://c22e5cf4-338a-4003-9cad-c1cb0be29285.filesusr.com/ugd/3db607_b26dd1fb7dce4ab5aa5596b009dba419.pdf?index=true
    • http://dafizetegepiri.rf.gd/vadoxolozired.pdf
    • http://kulixuvomewono.epizy.com/preparing_ethanol_by_fermentation_lab_report.pdf
    • http://zakefozufasedi.epizy.com/zuzizewuwomamipaxefufatu.pdf
    • https://8ab1a2d5-e5b1-44c5-a28c-e09959565f0d.filesusr.com/ugd/eb712c_11e4d3ca881f46ba81e8223bb7d089d9.pdf?index=true
    • https://8d90b851-447f-4cfc-ac95-1e867b71b983.filesusr.com/ugd/b371d9_c806960fccdc4478bb83b7ccb471d88a.pdf?index=true
    • http://gegurobaz.myartsonline.com/coaching_agile_teams_book.pdf
    • http://limoxukuk.atwebpages.com/vaxofelu.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000112e4.bin
8d53aa90d9175b94dfcbfb8d6361ca84b13aa377d3a4fdc3647ffc86d3d5ec31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112E4 5452 bytes
font_01_sfnt_off00012565.bin
1ce084880c649e1ca15b927f40c59e15aa7480619e69a74b3f693bcc18969bcc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12565 11280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.