Malicious PDF — malware analysis report

Static analysis result for SHA-256 29a39ccba1d61efd…

MALICIOUS

PDF

67.6 KB Created: 2021-04-27 09:23:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4864e4d2cac0e17344484d98e95a1e01 SHA-1: 7b90806b507d8fbdeb4576718010a821169ee085 SHA-256: 29a39ccba1d61efdbf28d744c546cc02d73f917f3a08140906c02ba7eb4d2567
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many pointing to disposable domains, and is flagged by heuristics as a link farm and potentially malicious. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though partially corrupted, suggests a lure related to 'paranormal romance books' and includes metadata from wkhtmltopdf, indicating it was likely generated programmatically to host these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7828

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=best+paranormal+romance+books+adults
    • http://baderezu.scienceontheweb.net/bus_116.pdf
    • https://cdn.sqhk.co/pifajaloro/jcZ4E5k/ghostrunner_ps4_release_date.pdf
    • https://cdn.sqhk.co/desogepupema/hc0FKii/48570527380.pdf
    • http://foselosen.sportsontheweb.net/concepto_de_enfermeria_en_salud_publica_segun_la_oms.pdf
    • https://cdn.sqhk.co/nupegefozub/yhe0ghK/brilliant_earth_moissanite_rings.pdf
    • http://zonizubiro.getenjoyment.net/28742270750.pdf
    • http://jufumabenosenup.iblogger.org/19493675165.pdf
    • https://cdn.sqhk.co/jetirivotu/dyNDDNK/62202716236.pdf
    • http://forovasax.medianewsonline.com/24786325390.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zitawajizotifam.epizy.com/93041553835.pdf
    • https://9c12218e-e157-4070-b33f-4467b3cb42bb.filesusr.com/ugd/0c60a0_973226b54db74234bf66d2f54f78fa3c.pdf?index=true
    • http://tojederetesez.epizy.com/luzizafal.pdf
    • https://s3.amazonaws.com/jivamubug/chief_executive_officer_cv_template.pdf
    • http://wozimape.onlinewebshop.net/agneau_de_dieu_qui_prends_nos_pchs_partition.pdf
    • https://s3.amazonaws.com/lososimap/50430499902.pdf
    • http://dudaturid.rf.gd/mla_8_in_text_citation_report.pdf
    • https://f38be386-5799-403b-9303-fb121113655a.filesusr.com/ugd/6f1aa7_66dba781cf3b4554a199bcf87f88cc1e.pdf?index=true
    • https://s3.amazonaws.com/sefepugolupalax/disney_cast_member_holiday_discount_2020.pdf
    • https://b3709dad-42f4-4621-9b7e-74d31ca978cd.filesusr.com/ugd/f91cf1_ae9090d879d74659a555adab2d5ff6f8.pdf?index=true
    • https://dce09894-55e7-49e1-9c43-b94069c58f23.filesusr.com/ugd/11ae40_f025d60b28f94a3aa2a4c3e7b718d1b3.pdf?index=true
    • https://4d75d3c9-3a4d-4df6-84ab-e48b83d723e5.filesusr.com/ugd/cdb50c_e530819a01dd452096922029abd07431.pdf?index=true
    • http://naremijex.epizy.com/wuvegati.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fec6.bin
afa3563df1975faa20a9f40a1306b2262e7fd4338e3a2fc4fba9c52e4dfc9e5c
pdf-font-stream PDF embedded font (sfnt) at offset 0xFEC6 5472 bytes