Malicious PDF — malware analysis report

Static analysis result for SHA-256 3252a3640d78f493…

MALICIOUS

PDF

77.0 KB Created: 2021-03-30 00:57:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 799435803a390e40dc95c2965487c56f SHA-1: 561891cd2a2ced0b9f970425bc2740d14fe0ff14 SHA-256: 3252a3640d78f49311416f7363f58d852dd20c6c69c11c91cfba97b3c4458357
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to disposable hosting and potentially malicious domains, as indicated by the PDF_SEO_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM heuristics. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the presence of embedded URLs and the overall structure point towards a phishing or malware distribution scheme, likely using the document body as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=kidkraft+savannah+dollhouse+costco PDF link annotation
    • http://myluckybet.xyz/xesanekonipmvh.pdfIn PDF document text
    • http://hook-up.fun/howls_moving_castle_theme_song_piano_sheet_musicpycty.pdfIn PDF document text
    • http://dnepr24.info/364268643713lnah.pdfIn PDF document text
    • http://predouche.xyz/bright_beginnings_soy_pediatric_drink_nutrition_informationjb803.pdfIn PDF document text
    • http://luminar3-download.xyz/royal_canin_puppy_milk_feeding_guide0cqsu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/879dfcef-4594-4c56-b103-81000a94301a/peter_hoff_bayesian_statistics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ed31e43-02da-4eca-a08a-acf3eb714906/date_renaissance_franaise.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1b92ba3-af59-45b2-a076-3ca9b13f788b/sql_in_10_minutes_a_day.pdfIn PDF document text
    • https://9e9203d9-9f5b-42f2-a849-05e42d741f90.filesusr.com/ugd/3527d5_eb20b0c14d81465eb70809519d9ed621.pdf?index=trueIn PDF document text
    • https://3d3b31fc-6152-41c7-b1d4-a4af3afcce63.filesusr.com/ugd/3f8d85_71bfec0b28ee4f1b9289f63d85324f99.pdf?index=trueIn PDF document text
    • https://6acf0ca1-aa41-4771-8b91-54baff69ee7f.filesusr.com/ugd/7d1dc9_29ce3143e10a46b2bbf81220b89153dc.pdf?index=trueIn PDF document text
    • https://ff743420-c5e2-4527-a456-70ddb2a1abd8.filesusr.com/ugd/5178f2_8e570c31840c4a948d32941ba550805a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dde3e277-84ad-462b-b649-0f3ce3549bd7/28251880492.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3ab082a-a527-4cba-bb31-034c78803d32/971114096.pdfIn PDF document text
    • https://b3709dad-42f4-4621-9b7e-74d31ca978cd.filesusr.com/ugd/f91cf1_cb3eb63c2f8c4ddcaef27c3dbf4d5389.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebff5b8e-3fb7-482f-99de-e7289fd8c9d7/43147474008.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6b66175-6ab2-4b6e-9234-d30350082136/22299268697.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/acd989a3-5813-4eff-b7ca-63c8002ef8bc/75971165906.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0999609c-0d81-4bb5-9c2f-02e6862f2ab2/how_to_do_the_factoring_method.pdfIn PDF document text
    • https://29ca30ec-7ad4-487f-8637-d2d67f3a323c.filesusr.com/ugd/10b11f_9c73c05cc3df4ae797b44d3a9957a347.pdf?index=trueIn PDF document text
    • https://de99c131-68bf-4271-bcef-cda292486844.filesusr.com/ugd/f5892c_b7d92a32b19f4a1a9d96acccfaef22db.pdf?index=trueIn PDF document text
    • https://1ec9b6e7-17eb-4e1e-a994-ba5ce4cbdb7c.filesusr.com/ugd/d4a9d6_4106c7b987324dbd9e24c20273a680a0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/43abf1ab-4fc3-4992-86fb-fc08ce7c9c76/blackjack_strategy_table_guide.pdfIn PDF document text
    • https://4c69d07c-928c-405f-a1ab-6436392658c4.filesusr.com/ugd/4c264d_831c64cfebaa4065968aa4b57a7b644f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9393f81-4e86-4f11-8307-8474e32e0798/verizon_fios_remote_not_working_with_tv.pdfIn PDF document text
    • https://c84d532c-3b33-47d6-96aa-4134a1164eb1.filesusr.com/ugd/6d45f6_107e34c6c75d4b39beb2c76496373c3f.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED1A 5204 bytes
SHA-256: 42dd07f1c75fba307d7fb16f10eeae8de41e852b0d6c7a90239c5ac0099b466a
font_01_sfnt_off0000fecf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFECF 11632 bytes
SHA-256: b90fdc6f455cc13cb753b6cf725c3206c9329f8370edb5cc434e0c6c33059738

Open this report in the interactive analyzer, or submit your own file for analysis.