Malicious PDF — malware analysis report

Static analysis result for SHA-256 35cea1000b97aff2…

MALICIOUS

PDF

79.7 KB Created: 2021-03-18 19:47:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 2985fd651cc6f3c5aacb68602ff44fc5 SHA-1: c86d7712b3470b2819cfbfcadd92765a0513b94d SHA-256: 35cea1000b97aff22659f122827b502d75adecd7015694a26a81b99d64b50bd2
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is a PDF document flagged as malicious by ML classifiers and ClamAV. It contains numerous embedded URLs, with a significant heuristic identifying it as a link farm on disposable hosting. The primary attack pattern involves directing users to potentially malicious sites, as indicated by the URLs and the 'link farm' heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=what+does+beautiful+disaster+mean+in+latin PDF link annotation
    • http://smm-target.ru/76423165321xy5d0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449766/normal_5fcf2f33a3824.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369626/normal_5fd260a5a771f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482023/normal_604ae2fe8d691.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456132/normal_603ee3857ccae.pdfIn PDF document text
    • http://ravovenovibu.medianewsonline.com/who_are_the_main_characters_in_the_selection_jiskha.pdfIn PDF document text
    • http://marafonsport.site/fefuvefiwuguramololijuj8csbv.pdfIn PDF document text
    • http://mini-cam1.club/best_operating_system_for_chromebookyvvdk.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369784/normal_5fca80719033d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472208/normal_604cdfc99fd26.pdfIn PDF document text
    • http://my-favshop.online/japazarepuxaff6pdq.pdfIn PDF document text
    • http://bitcoins-profits.com/jabidemetadoluzulvzpp.pdfIn PDF document text
    • http://mugukix.mygamesonline.org/wonaxevevisotuvojewakufa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412592/normal_60434ca0b1143.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zugutixe/billfish_fishing_report.pdfIn PDF document text
    • https://be08d7d4-326a-4801-be9d-4496af17a43b.filesusr.com/ugd/d31907_9b7f3114c7a941b49083ed068f5a05c9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vobuturinivi/neumonia_perros.pdfIn PDF document text
    • https://s3.amazonaws.com/nisiwanolom/dixefivatimodepenifaveri.pdfIn PDF document text
    • https://cceb078e-1df6-42b0-9e12-359f30e42f1d.filesusr.com/ugd/e8506d_dce4f4b0fa174b8ab026b4aef690abfe.pdf?index=trueIn PDF document text
    • http://pivimufe.atwebpages.com/daftar_harga_kabel_supreme_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/dinilederu/3249448469.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eefe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEFE 2900 bytes
SHA-256: a28fcc4ba65d8171a55e8b87d646ac5d1dd213f66ab2b0026fd39e5ca5d32d1a
font_01_sfnt_off0000f940.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF940 5300 bytes
SHA-256: 9079cf8117656c7f5514fdc3df1dc573bebaa27024183e1b8ab5710a0ff01d7d
font_02_sfnt_off00010b22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B22 11072 bytes
SHA-256: ef4b09c869cf3a54ae2766bd342ea06ca78597bf9a26ab67176d98410a7c2e49

Open this report in the interactive analyzer, or submit your own file for analysis.