Malicious PDF — malware analysis report

Static analysis result for SHA-256 27a0f0d3f46d7d59…

MALICIOUS

PDF

80.9 KB Created: 2021-03-06 20:48:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 9a2e75b55b3a79ff5072284c0365c684 SHA-1: a896d974b536477964b758b2f8aa5d3313cc491c SHA-256: 27a0f0d3f46d7d591c37f2c69ae997d6ed621fda6bb061991fed3f0179676dba
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning model indicated a high probability of maliciousness. It contains a large number of external links, many of which point to disposable hosting, suggesting a link farm or SEO spam operation. One of the embedded URIs, 'https://dugedepap.ru/wix?keyword=improvisation+28+expressionism', is likely the primary lure, directing users to a potentially malicious site. No scripts were extracted, but the PDF structure and numerous external links indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=improvisation+28+expressionism PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4404290/normal_5fe7a196374be.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4494149/normal_5fcaff782802f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384650/normal_5fe6b309337c3.pdfIn PDF document text
    • http://pixunune.sportsontheweb.net/christopher_hitchens_ten_commandments_vanity_fair.pdfIn PDF document text
    • http://pogibofabut.getenjoyment.net/washington_dc_weather_in_march_2019.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384650/normal_5fe4e278a810e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/a05a98d5-637e-4910-990b-9d7478de25aa/fim_assessment_cheat_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ca62750-98a1-4d6c-a007-d8356493dec4/basupaleguxulagudanin.pdfIn PDF document text
    • https://d4508431-0eee-4913-ac2a-2ec907ed9b18.filesusr.com/ugd/12daa7_ab500fe4a8604ca7ad6ce14defb944df.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jebokizez/why_dryer_not_heating.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47efd161-5b8f-45da-b627-1ec73351530e/jerarqua_de_los_valores_de_max_scheler.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3bf3129-ccda-4cce-8772-0b8106f84352/simplex_4100es_fire_alarm_control_panel_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b54c786-c8ab-47ef-96c9-a28a757b34e7/miwalavonizotarazuda.pdfIn PDF document text
    • https://57eba762-b826-4879-8d7a-7f480aba2934.filesusr.com/ugd/e89c2b_da0c1351e5fc4d79b62233cce741e066.pdf?index=trueIn PDF document text
    • http://nizowozutagele.atwebpages.com/26825147899.pdfIn PDF document text
    • https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_322839c19a9642afac03507c962aaab3.pdf?index=trueIn PDF document text
    • https://dd7ee03d-3646-4e01-a1e1-4c0a7e2c9e57.filesusr.com/ugd/d7ba0f_4935833f1a5d4ece975096a3f667d913.pdf?index=trueIn PDF document text
    • https://ae0ecf71-49bb-4ac4-bba4-d0f2a20d1af9.filesusr.com/ugd/668a47_c1f85e11463943c5ab87daad5704f2f6.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7eabb4fd-8ab8-4461-bb75-9ef5a1a655b8/folded_book_art_tutorial_letters.pdfIn PDF document text
    • https://s3.amazonaws.com/rexogeguxosix/wupozixi.pdfIn PDF document text
    • https://s3.amazonaws.com/bojafazes/xixuk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1aa702ed-0d64-43dd-8686-f96952b61204/27014492991.pdfIn PDF document text
    • https://s3.amazonaws.com/lowebemuwojiso/formule_brute_du_bicarbonate_de_sodium.pdfIn PDF document text
    • http://jasesazolaf.myartsonline.com/hearts_of_iron_3_mods_steam.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1B7 5112 bytes
SHA-256: 15a31fb618f6f0608482c923dba3f81776ba1e6a5ea5ad5f414dcb78d176ddab
font_01_sfnt_off000102f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102F2 10860 bytes
SHA-256: fc95ecaa06659c814e394636bf3f48e919a408ec02bffb173b98a754fec09c74
font_02_sfnt_off00012822.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12822 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.