Malicious PDF — malware analysis report

Static analysis result for SHA-256 27a5013957ab4868…

MALICIOUS

PDF

113.9 KB Created: 2021-06-10 11:37:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: c6daba5f981fab972fa06a64ed12ce86 SHA-1: 3c3557d7745e2a6629b71240574b739e1454c7ce SHA-256: 27a5013957ab486801c88fac66a157da0fd5f3cc03f4f5c03dc697bd0c899057
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics as a link farm, containing numerous external links. The ML classifier and ClamAV also identified it as malicious, specifically as a phishing or trojan variant. The primary purpose appears to be SEO manipulation or redirection to potentially harmful content via the extensive list of URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9908

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=desh+bhakti+geet+dj PDF link annotation
    • https://tawatoxox.weebly.com/uploads/1/3/4/0/134018263/gixuruk.pdfIn PDF document text
    • https://bilewazivabo.weebly.com/uploads/1/3/2/8/132816117/xedakefosor.pdfIn PDF document text
    • https://xakelagus.weebly.com/uploads/1/3/3/9/133997825/dofaris.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://lekuzax.pbworks.com/w/file/fetch/144417159/pekaxofamesejamositunuze.pdfIn PDF document text
    • http://ximusutoj.pbworks.com/w/file/fetch/144965217/best_fake_followers_app.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10cda42b-6f16-4160-8dc1-9ea00db07143/78969400877.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d9114fa-d66f-4f62-b31b-c7406a06c606/how_busy_is_disneyland_in_december.pdfIn PDF document text
    • http://sofutikajen.pbworks.com/f/urdu_fonts_free_download_for_android_mobile.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62fd427f-2f4f-4511-9bd9-1d1b5fd6e7df/19429602490.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/157fdaec-9bd9-4eaf-85ea-351c14527a73/posipawup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1abe1b6-85cd-412a-b680-e4c910f6928d/zedunazov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e0d5734-8f66-4f06-87d2-0de826a13148/xufefuguloxegeveferogu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3513afb9-520e-4764-b062-e8d2842c12a7/jexabigomurifu.pdfIn PDF document text
    • http://kufavuva.pbworks.com/w/file/fetch/144652731/daily_office_expense_excel_sheet_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/816d2adb-98c5-4323-a912-27d7d69b93c7/samsung_refrigerator_rf263beaesr_parts.pdfIn PDF document text
    • http://pekazaxe.pbworks.com/f/tokamogibaz.pdfIn PDF document text
    • http://tubekikewabi.pbworks.com/w/file/fetch/144453276/bozezuwifirojagawof.pdfIn PDF document text
    • http://togiwuvoze.pbworks.com/w/file/fetch/144579228/juguwewovabamomevol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/809559ff-f389-4b24-95fa-85b967ce1c66/74908118433.pdfIn PDF document text
    • http://xesimisejek.pbworks.com/f/jebuwuwivoruniferu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109F0 4812 bytes
SHA-256: e8fe46b293d97e71d6e57f58da580146318b974c30cee8554a60781d3f994187
font_01_sfnt_off00011a58.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A58 3720 bytes
SHA-256: a7c194c348f4bc26aad06ae1fa1eadf76503a3aca856ff80314c3d87a816eea9
font_02_sfnt_off000125b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125B0 8368 bytes
SHA-256: d22ba4218d7646991d9789ab4ff528a3910bffd179fad14a871c54d064693d58
font_03_sfnt_off000140e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x140E4 11952 bytes
SHA-256: d6ee2f03f7bf925a3107b7915472ad8e2070e1d571cf674a50b42985da17cb97
font_04_sfnt_off00016954.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16954 16492 bytes
SHA-256: 3ace622194002f38be14bbfe8fb4b5cf519fc16b238c32d30c1da3dd45bedfb6
font_05_sfnt_off00017f4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17F4B 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230
font_06_sfnt_off00018d4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18D4C 14648 bytes
SHA-256: 7c9de198753f1b858490e8433bb2a745437ce457d668f2eab269b2241c25d303

Open this report in the interactive analyzer, or submit your own file for analysis.