Malicious PDF — malware analysis report

Static analysis result for SHA-256 309dfecae2298680…

MALICIOUS

PDF

92.6 KB Created: 2021-05-07 05:44:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a8ca9a1c34893b7887d29c7601e89a0 SHA-1: 22108749523eb2121099b3ba10a830c46378c9fe SHA-256: 309dfecae22986800cfd5d2f512b3e527eed8daa4204724daef5da081a9d38e0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting it is part of a link farm or SEO manipulation scheme. ClamAV detected it as Pdf.Phishing.Trojan, and an ML classifier also flagged it as malicious. The primary purpose appears to be directing users to other potentially malicious or spam content hosted externally.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=bodas+de+sangre+descripcion+fisica+de+los+personajes
    • https://mujunoba.weebly.com/uploads/1/3/2/6/132682006/3461520.pdf
    • https://remogomati.weebly.com/uploads/1/3/4/7/134748537/nimivagebida.pdf
    • https://lemefinafotujux.weebly.com/uploads/1/3/4/6/134606632/9893177.pdf
    • https://nemelodanunoju.weebly.com/uploads/1/3/0/8/130874480/3123160.pdf
    • http://axecheat5.xyz/aliexpress_coupon_codeguod6.pdf
    • https://rosujukasawi.weebly.com/uploads/1/3/5/3/135301647/toxemiruwebilox_soguribu_goxebuzepupa.pdf
    • http://stav-games.ru/hl-2270dw_brother_printer_driverzb69a.pdf
    • http://help-feedback-amzn6.xyz/jacdec_airline_safety_ranking_2020jj3tk.pdf
    • http://virubedasiv.22web.org/bitlocker_android_apk.pdf
    • https://jikuvubavul.weebly.com/uploads/1/3/5/9/135964228/3328bd807d.pdf
    • http://gratoramaa.space/donde_estas_bernadette_descargartu7z6.pdf
    • http://technodom11.com/puforipudixir2sv2s.pdf
    • https://sesuxaned.weebly.com/uploads/1/3/5/3/135349378/vepurizuxawe-piwefi.pdf
    • https://lujinelux.weebly.com/uploads/1/3/4/3/134361227/xobabadifiv.pdf
    • https://jenodaxadow.weebly.com/uploads/1/3/4/0/134012655/411277.pdf
    • http://2022god.com/48347000395ta0v5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7f793f8f-877f-420e-851b-8bae9ea62a4d.filesusr.com/ugd/78c764_f6bb348888674ad4bbab3c70b6f60fb8.pdf?index=true
    • https://f2182bdb-ca8e-4fe7-b379-f84e14eeb57e.filesusr.com/ugd/026bcc_af842ff263ab4b12adf030bf33cc90eb.pdf?index=true
    • http://defasawune.epizy.com/51518645338.pdf
    • http://jubadune.rf.gd/18108643040.pdf
    • https://6ce95562-7558-49ee-a7b0-b3003db3b0e9.filesusr.com/ugd/d13e1f_f672e495c28947568fead4401cf47fc9.pdf?index=true
    • https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_cd7aecc55f32448094ba2a9d4f3604a7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012ab6.bin
e477a1e27467a933eec0868aa6fb02e39ce47b8a27a1c289ec2a15385a19f016		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AB6 5448 bytes
font_01_sfnt_off00013d5a.bin
2511b38f9011abc8ea40b4b6c5367bc773917acb92b48c03fef78087f33ec8d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D5A 12384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.