Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f914feba252c96d…

MALICIOUS

PDF

77.8 KB Created: 2021-05-31 01:44:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 610753e6d680a23e22a3bfd11c4ac09d SHA-1: eb94750b9fd804c4ad2274b6ef17aa4695a65cbd SHA-256: 2f914feba252c96de8431f8581faf9eeffa44fb3328bf876c2cc20a1dc5dffc1
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier. It contains a large number of external links, many pointing to other PDFs, suggesting a link farm designed to distribute malware or phish users. The primary malicious URL identified is https://golowaki.ru/strik?utm_term=ejercicios+con+las+tablas+de+multiplicar+para+ni%25C3%25B1os+de+primaria, which appears to be part of a SEO-based distribution scheme. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=ejercicios+con+las+tablas+de+multiplicar+para+ni%25C3%25B1os+de+primaria PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4366319/normal_604cc0c8bbdd6.pdfIn PDF document text
    • https://kowabimope.weebly.com/uploads/1/3/4/3/134359524/4157ab9.pdfIn PDF document text
    • https://solupezonideb.weebly.com/uploads/1/3/4/5/134597414/5936529.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368226/normal_603e4184da0e1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369632/normal_5fd042379332f.pdfIn PDF document text
    • https://rebifigu.weebly.com/uploads/1/3/4/6/134663288/puwukezawut-tebesorufovapat.pdfIn PDF document text
    • https://dexixafavako.weebly.com/uploads/1/3/4/3/134348567/mimiwusez_pufip_pumabovananoj.pdfIn PDF document text
    • https://juboxunogaruf.weebly.com/uploads/1/3/4/7/134700559/zowiba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384142/normal_5ff765c362bc7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/aafc855a-24cf-4f64-8daa-35cb9901fdd9/cara_hack_internet_download_manager_registration.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a890a78b-e6fd-449f-ae29-f46999f5ac51/futeregufimikifubi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9235df28-6842-4f9c-bbe7-1ce945a56eb5/46094358929.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebe45052-fe5b-4ab7-8922-708639b8a341/sex_offenders_tyler_texas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e06d3acd-ed5b-47b6-a94d-f7b7cdedd20c/tefiwotadobemanibutorifo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77ad6dbe-8672-4de2-a927-b116e51fe0f5/what_is_considered_as_dangerous_goods.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1defb61d-da1f-4022-b5f7-317420793d25/jerelu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/509c871c-c5e2-40ec-893f-b8408fef5faa/29674168316.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ed9ae89-8e1a-49f6-8a38-9244f83a3a69/difference_between_bacterial_cell_and_virus_cell.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/71cc67be-c79d-4f62-96b4-465c0b233ad8/gilibe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/71524e4f-4edb-470f-bd9a-e03a46845f8f/walmart_pharmacy_giving_covid_vaccines.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e051.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE051 5488 bytes
SHA-256: ce826b70d1a1a766c2699b7d2ff9b05f4476bd9c6c94ba65a812eae883a474ea
font_01_sfnt_off0000f28f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF28F 11620 bytes
SHA-256: 8ddad1b1ee79ab5ee082d682f57f477d7b840995ceb586003528e43c521100aa
font_02_sfnt_off0001181c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1181C 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.