Malicious PDF — malware analysis report

Static analysis result for SHA-256 29b00d353a063d92…

MALICIOUS

PDF

81.8 KB Created: 2021-03-10 02:52:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: e97d02f1b1ed5f8ca29f12e07028ea83 SHA-1: 89469e69b3feff55601223675cb068b5e1177e3e SHA-256: 29b00d353a063d92cad82a954b1107a5a37ca6e07877c1edbe26dc26b1906065
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many hosted on disposable domains, which is indicative of a link farm or phishing campaign. The heuristic 'PDF_SEO_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly suggest this malicious intent. The presence of a URL related to 'dividends from apple' in the document body further supports a phishing or scam lure. No scripts were extracted, but the overall structure and link distribution point to a malicious PDF designed to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6680

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=how+to+get+dividends+from+apple PDF link annotation
    • https://woraragupawajup.weebly.com/uploads/1/3/2/6/132681931/daserazov.pdfIn PDF document text
    • https://gibitomenufe.weebly.com/uploads/1/3/4/0/134041720/6681528.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454170/normal_5ff31cc105ea1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497368/normal_602e84f8d8d0f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460063/normal_5ff8fd2a889b3.pdfIn PDF document text
    • http://nalomojup.22web.org/gmat_analytical_reasoning_questions_with_answers.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427781/normal_603202e4b1b5a.pdfIn PDF document text
    • http://gudibetujem.iblogger.org/bus_games_free_for_mobile.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482208/normal_5fca8b25923fa.pdfIn PDF document text
    • http://fizovovapoz.iblogger.org/how_do_you_cite_an_ebook_in_chicago_style.pdfIn PDF document text
    • http://zenododuro.iblogger.org/56221172391.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://ridabus.epizy.com/21840111514.pdfIn PDF document text
    • http://bolopanezodubun.rf.gd/sheetz_job_openings_near_me.pdfIn PDF document text
    • https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_dc4ff70b43224c1990261c916826b93a.pdf?index=trueIn PDF document text
    • https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_67cf8799d61942f2a8fe07678a3cd634.pdf?index=trueIn PDF document text
    • https://f9c81679-ddb1-4746-ab40-32673edc426c.filesusr.com/ugd/2eff39_a2c3f48e6f0d4460a11cf689963d1c15.pdf?index=trueIn PDF document text
    • https://ec679cc6-872a-45a8-b2fd-b1bc8f6ddb77.filesusr.com/ugd/d1d005_3dbcbd0f81404c1784050c385bb9fc65.pdf?index=trueIn PDF document text
    • https://bc260b4e-efc2-469d-9102-9c7234992d76.filesusr.com/ugd/b1b3ad_fc8860eaef044a278d9ac4dc6bd9c558.pdf?index=trueIn PDF document text
    • http://nipuxedexup.epizy.com/68204363241.pdfIn PDF document text
    • https://ecfc1f44-6648-4072-bff5-6ee4adcfbe4f.filesusr.com/ugd/e5a943_5fc670c18b56472b8f606819b29d8986.pdf?index=trueIn PDF document text
    • https://1cbf0fd9-62af-4102-a3dc-982f361539e7.filesusr.com/ugd/bfbc46_cd35bd1be1144a7dbb965577a9a22be3.pdf?index=trueIn PDF document text
    • http://banudozege.epizy.com/how_to_setup_tp_link_tl-wr841n.pdfIn PDF document text
    • http://gelofobomafagez.epizy.com/what_were_the_three_estates_of_france.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000133e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x133E7 5472 bytes
SHA-256: 90196dc1ff3d79bca17fc8f089cd22ae8bbb14f29e24168dcad273a1fa2c91a2

Open this report in the interactive analyzer, or submit your own file for analysis.