Malicious PDF — malware analysis report

Static analysis result for SHA-256 27137d0dd9cac8eb…

MALICIOUS

PDF

86.8 KB Created: 2021-03-23 12:43:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 27eea7746423fe8ee65289a8ec8c9a55 SHA-1: 304f48d8b0c4dbdb0e0322a3a123318c9bdc27bd SHA-256: 27137d0dd9cac8eb673071f8b04a2220f876c8d86c4a10138de6002c06a732ea
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which point to potentially malicious domains, suggesting a link farm or SEO poisoning attack. The presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' strongly indicate that the document's primary purpose is to redirect users to these external sites, likely for malware distribution or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=smart+couples+finish+rich PDF link annotation
    • http://trastqort.online/zafopozesojory71fp.pdfIn PDF document text
    • http://autocredit.moscow/85245583820jash9.pdfIn PDF document text
    • https://xemageka.weebly.com/uploads/1/3/1/3/131380316/fasosadi-muribalujiper-kijalexaja-tabitele.pdfIn PDF document text
    • https://tekeginisexufu.weebly.com/uploads/1/3/1/3/131381150/2a1d517649e.pdfIn PDF document text
    • http://bijowuxupolapi.sportsontheweb.net/lopalobiviv.pdfIn PDF document text
    • https://cdn.sqhk.co/xuxozowaki/XuydrYx/ufc_prelims_tonight_uk_time.pdfIn PDF document text
    • http://instapriz365.online/65891754799cg19.pdfIn PDF document text
    • http://lofajemami.sportsontheweb.net/midnight_sun_stephenie_meyer_book_2.pdfIn PDF document text
    • https://cdn.sqhk.co/vakolitakap/f5DIpjg/titan_quest_ragnarok_best_build.pdfIn PDF document text
    • http://soldatskaya6.ru/kajupafoxukuw2plg0.pdfIn PDF document text
    • https://cdn.sqhk.co/peluxisomex/Cgjgfig/jovufelureboxaju.pdfIn PDF document text
    • https://go.bestbookbits.com/freepdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://pikubub.onlinewebshop.net/94566470895.pdfIn PDF document text
    • https://s3.amazonaws.com/dusubonifu/16655130417.pdfIn PDF document text
    • https://s3.amazonaws.com/xanunafojuloki/rekupopipegigogi.pdfIn PDF document text
    • https://s3.amazonaws.com/gajabedafot/hurricane_florence_news_report.pdfIn PDF document text
    • https://s3.amazonaws.com/sizabo/12917088400.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/bali_umar_ko_salaam_ming.pdfIn PDF document text
    • https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_85197247ea1c403aaaf9e018f8912bd4.pdf?index=trueIn PDF document text
    • https://fe2b84af-b373-48e0-a714-f820169e3fe9.filesusr.com/ugd/ed1d2e_8604a44a56564775b4033675cdba3c08.pdf?index=trueIn PDF document text
    • https://3a0d5408-2ea1-4258-8d29-5d96341cad2c.filesusr.com/ugd/79cb75_8d0c69b1299f4b3fa5d6a32950134f0b.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f210.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF210 5356 bytes
SHA-256: 22c1cc3e85f149f731373165c0ae54518954b97e28584209a52031112a00cf41
font_01_sfnt_off0001040e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1040E 3008 bytes
SHA-256: acf7d9861d8d82245f597c09b19d56214759b0442b82a7f17518e499c823f8f1
font_02_sfnt_off000110c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110C0 11272 bytes
SHA-256: d6715cf464d4a5ab16dbba6554876dfd49166751b4134c36e25396a54cf6f735
font_03_sfnt_off000136df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x136DF 16092 bytes
SHA-256: 9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2

Open this report in the interactive analyzer, or submit your own file for analysis.