Malicious PDF — malware analysis report

Static analysis result for SHA-256 27d7409e68d316fa…

MALICIOUS

PDF

69.6 KB Created: 2021-03-31 22:43:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 7ad8338fc7f39190afdc9cbf4be30e63 SHA-1: 508b2e26e50ca1cba65b633b785bdf99c95e8f2c SHA-256: 27d7409e68d316fafa7fc173468eb4e8d3e1eab2b5c40bd9e5add0b94e6ed4f8
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, many pointing to disposable domains and link farms, suggesting a phishing or malware distribution scheme. The document body, though partially corrupted, references 'Power book 2 episode 6', likely a lure to attract victims to click on the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7003

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=power+book+2+episode+6 PDF link annotation
    • http://idealica-italiaoficial.site/ejercicios_para_completar_lista_de_verbos_irregulares_en_inglesm3xq8.pdfIn PDF document text
    • http://disclosures.space/cual_es_mi_calendario_aztecavvitf.pdfIn PDF document text
    • http://kind-insta.site/the_birds_and_the_bees_word_origin8yqb3.pdfIn PDF document text
    • https://cdn.sqhk.co/datawafag/gek99h2/povijazolugarogevaz.pdfIn PDF document text
    • http://itfamily.pro/10061154721a4fal.pdfIn PDF document text
    • http://buyfastedcircle.xyz/water_and_wastewater_engineering_design_principles_and_practice_second_editions8kfp.pdfIn PDF document text
    • http://ruzopiter.iblogger.org/brassage_gntique.pdfIn PDF document text
    • http://pexovowa.iblogger.org/36740911753.pdfIn PDF document text
    • https://cdn.sqhk.co/nakoxofo/RfjdThc/guide_camping_car_italie_du_nord.pdfIn PDF document text
    • http://megalit-korolev.ru/wajatafixurzkd6.pdfIn PDF document text
    • http://dfahsdfgjsfg.online/why_did_the_renaissance_began_in_italy_and_not_another_part_of_europex9e8a.pdfIn PDF document text
    • http://yildirimotobursa.com/linkin_park_2020_newsjhhd2.pdfIn PDF document text
    • https://cdn.sqhk.co/rixutixim/ifhhmhg/the_room_place_outlet_on_north_ave.pdfIn PDF document text
    • https://cdn.sqhk.co/vixukose/Rebiihj/rafekuzesizusapuzijuxadaw.pdfIn PDF document text
    • http://netlysy.online/44683386954egsu2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://b564fea6-732e-489f-a029-a72dc6590de2.filesusr.com/ugd/6a4619_f44be75ac85a4e0abfb1e23578f95403.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wivunonovef/18411302853.pdfIn PDF document text
    • https://99f4a897-b223-4833-863a-50ad465ba5d5.filesusr.com/ugd/8e2371_d1f4db8508ae43efb512d1d70c2fbbc2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/limepusotanal/software_system_implementation_plan_template.pdfIn PDF document text
    • http://sekudevabadim.rf.gd/27532400311.pdfIn PDF document text
    • https://a62e46b8-d933-4087-892c-e5439cec6991.filesusr.com/ugd/e9cba9_548cd1c5d8d144c6b77e3defcd2a7070.pdf?index=trueIn PDF document text
    • https://43cb2d18-1589-43a7-b1c5-fe1278e1c76d.filesusr.com/ugd/370b54_90a5b68dd6fb493fac0a290ae572cd5d.pdf?index=trueIn PDF document text
    • https://8a833fea-7c9a-4d2e-a5a7-d3590f42a3e5.filesusr.com/ugd/9aab09_4cfc1180938c4310a739ab455ce5a39d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/topipovikapari/aax_player_for_android.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f97d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF97D 4896 bytes
SHA-256: ce1bfd2753bd4747822fbcdfe3dca050f0453fb85652c49d87db5bb0d5079d3c

Open this report in the interactive analyzer, or submit your own file for analysis.