Malicious PDF — malware analysis report

Static analysis result for SHA-256 28ed1f581c093474…

MALICIOUS

PDF

72.4 KB Created: 2021-06-14 14:50:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: f59d77a3f190676cbabc1cefc6d975e5 SHA-1: 0c6615188485859c612a2b0baa2ccb60ad1c67cc SHA-256: 28ed1f581c093474af0761883e9d9b0f5af59f5594bb388fa354271cf0e4feb9
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, directing users to numerous external PDF files, with a primary URL pointing to 'synerhu.ru'. This suggests a phishing or content-luring attack pattern, likely intended to lead users to malicious websites or download further malware. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/pbw?utm_term=destiny+knot+pokemon+sword+and+shield PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4408002/normal_60c27fc93af8e.pdfIn PDF document text
    • https://lodarexuxune.weebly.com/uploads/1/3/4/3/134352809/1255553.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366625/normal_606b718558936.pdfIn PDF document text
    • https://fofapabijutoza.weebly.com/uploads/1/3/4/7/134713913/5940476.pdfIn PDF document text
    • https://migamusuzugu.weebly.com/uploads/1/3/4/6/134657386/e77e4be134f2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372980/normal_60342f6c02352.pdfIn PDF document text
    • https://zuvubexusemeto.weebly.com/uploads/1/3/4/3/134373725/tubexego.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483851/normal_606e4af3320d9.pdfIn PDF document text
    • https://vilukenuxe.weebly.com/uploads/1/3/2/8/132814007/6659197.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384308/normal_5fd7d627b2c01.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/669fdbc9-61c4-411f-9150-293c4b6d919a/45158570667.pdfIn PDF document text
    • http://funesut.pbworks.com/w/file/fetch/144745161/capture_one_20_manual.pdfIn PDF document text
    • http://veweran.pbworks.com/w/file/fetch/144432660/how_to_beat_the_egg_drop_challenge.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c5a8723-fbb0-4521-a5c3-b287adc8214a/penos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62d32a1d-968f-4ed5-9d4f-2c6bd92c0b1a/bigawe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87b1dd2a-d784-4c91-ac6c-080bb983cc97/return_to_sender_free_font.pdfIn PDF document text
    • http://jopamedet.pbworks.com/w/file/fetch/144444063/unblocked_games_castle_wars.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00f1c4ee-2747-4625-8083-263662feeb8d/sadazetejizupenerekuzot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8ac3b9f-f6b7-4de2-b62c-9e79488fa411/how_to_make_money_with_real_estate_rentals.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b35d5abd-2405-4655-a478-847e9b0fb299/xapaxajozogu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4c0a792-80d7-467a-9978-24cdfa9223e8/zomukokesoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3c8d959-ce74-4d94-a608-dd8dd0836060/mechanical_engineering_jobs_in_pune_for_freshers_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ab26299-4a2a-4da5-83b4-359482158f1c/axial_scx10_2_deadbolt_review.pdfIn PDF document text
    • http://bekojifutok.pbworks.com/f/vifojawerizixolemusokuze.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB4E 5456 bytes
SHA-256: 052623ba126d94f9106ec80687dd42bfce4527869de7917d47751480e341d8f3
font_01_sfnt_off0000edcd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDCD 11628 bytes
SHA-256: f56f199d3ab6a5a102885dc0589bc7e789b998aa58ac0635cade497db2991ffc

Open this report in the interactive analyzer, or submit your own file for analysis.