Malicious PDF — malware analysis report

Static analysis result for SHA-256 35313ffa60c47dcd…

MALICIOUS

PDF

76.9 KB Created: 2021-03-11 16:51:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: dc88acf473cd36fd5d052625883bcf07 SHA-1: d8b04e3374777b47a7309be2585f6c400a12d6c8 SHA-256: 35313ffa60c47dcdcf65927c65f0a492ed9a16db6662c304b2a7373730ed1a5f
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which point to SEO-optimized redirectors. The primary malicious URL identified is 'https://lozipotod.ru/award?keyword=srimad+bhagavatam+in+tamil+pdf+with+meaning', which is likely used to deliver a phishing lure or download a secondary payload. ClamAV detection and ML classification strongly indicate malicious intent, specifically identified as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=srimad+bhagavatam+in+tamil+pdf+with+meaning PDF link annotation
    • https://cdn.sqhk.co/benibavagoge/idgifuL/yeezy_v2_hyperspace_legit_check.pdfIn PDF document text
    • https://cdn.sqhk.co/nazujovo/kndjnji/13038808701.pdfIn PDF document text
    • https://cdn.sqhk.co/mogizilo/Jgg26jn/dr_dish_basketball_shooting_machine_price.pdfIn PDF document text
    • https://cdn.sqhk.co/soxuvezosapa/eijj4jI/fererusepesibalas.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://91953a53-6f32-4f2a-9b2e-0f954541ff31.filesusr.com/ugd/dad90e_e83c9f2e7f004f70b56ddff4238d0454.pdf?index=trueIn PDF document text
    • https://3176e400-c268-4dc0-8d69-08eae86937f8.filesusr.com/ugd/ea2f88_232dfdf9d84842cda3a6608dcc053b31.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fosagoba/96653948311.pdfIn PDF document text
    • https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_2d6f137128aa4a159c5cf321a380c4ee.pdf?index=trueIn PDF document text
    • https://2a009ac4-5770-49f2-ae16-4ce107243443.filesusr.com/ugd/59deca_6846ad9471e04ce486c5a9d09113cd53.pdf?index=trueIn PDF document text
    • https://d102a0f2-001f-4998-bb0a-88ac30ac05b5.filesusr.com/ugd/771ea4_4581bdcb978b4e69ae56daf8b666613d.pdf?index=trueIn PDF document text
    • https://cfecb619-c0f5-418d-ae9d-b1147643389f.filesusr.com/ugd/4cd51e_fb7402fe290f4d35b1f4294627318e16.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sepovutapakogaf/72969773668.pdfIn PDF document text
    • https://s3.amazonaws.com/vabedafozo/insect_word_search_answers.pdfIn PDF document text
    • https://c1e70603-6ca1-47bc-880b-b60d7d434995.filesusr.com/ugd/df625d_726903ee1a634c18b1eb4a0454ff8a92.pdf?index=trueIn PDF document text
    • https://5634f520-c25d-421d-ab67-3d94505d13cb.filesusr.com/ugd/1b85ab_7f652c77dcd14eeea7a25660eb3bf38e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bupijila/comparative_superlative_worksheet_esl.pdfIn PDF document text
    • https://e3055f73-6236-423b-b810-4bc1a15f300f.filesusr.com/ugd/fa12d1_7c273aa20c044745b1c3bdc7b94254f3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/napisakaluja/adobe_photoshop_touch_for_android_9._0.pdfIn PDF document text
    • https://s3.amazonaws.com/daxemo/druid_feats_5e_circle_of_the_shepherd.pdfIn PDF document text
    • https://0d3c4653-ec4b-4b04-9c20-59e348ba858e.filesusr.com/ugd/62200f_f475a0f7519f4cb794ca413916e31102.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc68.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC68 5672 bytes
SHA-256: 069f53c410be09c6f73aa52f6e935f50dd92d904d7d434955442b4c9f2dced6d
font_01_sfnt_off0000ef91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF91 3900 bytes
SHA-256: 1ed1cf5e61c0c48e89d7c1fbc01cd2e4c3d75590230c9b04b5ca6c591f4e23b6
font_02_sfnt_off0000fe3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE3D 10880 bytes
SHA-256: dafd13f7dbb294a55f280df9a337073c485e2cc22296a450707232162a9b65bd

Open this report in the interactive analyzer, or submit your own file for analysis.