Malicious PDF — malware analysis report

Static analysis result for SHA-256 35d8a53ecb7f978f…

MALICIOUS

PDF

69.5 KB Created: 2021-10-12 10:21:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-24
MD5: 874dcedebe14e9e2e025f5db802d658b SHA-1: f4bd97c3d14305b00ff3af5b521e15e83528ae0a SHA-256: 35d8a53ecb7f978f406de29b5b842806e6bc5ee696b006e5a4185a3a4c65d450
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external URIs, many of which are hosted on disposable domains, suggesting a link farm or phishing operation. The PDF structure and embedded URLs point towards an attempt to redirect users to potentially harmful websites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9965

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/uplcv?utm_term=standard+form+of+pair+of+linear+equations+in+two+variables PDF link annotation
    • https://santa.sg/images/users/00000000/files/morifedamofezud.pdfIn PDF document text
    • https://sunridgecorp.com/uploads/files/202109120306269776.pdfIn PDF document text
    • https://www.benkorner.nl/admin/library/ckfinder/userfiles/files/kidojurawav.pdfIn PDF document text
    • http://nuovartea.eu/userfiles/files/66260740594.pdfIn PDF document text
    • http://namadagaskare.ru/ckfinder/userfiles/files/32907873977.pdfIn PDF document text
    • http://mrpokedb.com/uploads/files/sesaredor.pdfIn PDF document text
    • http://odessawa.com/userfiles/file/zagetozigaganij.pdfIn PDF document text
    • https://shevian.com/images/file/2967546986.pdfIn PDF document text
    • https://rijst.nu/userfiles/file/fakowejopagasa.pdfIn PDF document text
    • http://spostojow.pl/userfiles/file/zumupubovokudo.pdfIn PDF document text
    • https://capitalsyndic.com/userfiles/file/47065556916.pdfIn PDF document text
    • http://chrisnoblelaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/56355171448.pdfIn PDF document text
    • http://rdasesores.gestconcursal.com/editor/ckfinder/userfiles/files/16824834535.pdfIn PDF document text
    • http://lifeisartfoundation.org/sites/default/files/images/userfiles/file/39792036782.pdfIn PDF document text
    • http://zamgph.com/FCKeditor/editor/filemanager/connectors/php/uploads/file/091247412369.pdfIn PDF document text
    • https://earthchartercities.org/wp-content/plugins/formcraft/file-upload/server/content/files/1616526816dfe4---pususoj.pdfIn PDF document text
    • https://artedeeducar.com.br/ckfinder/userfiles/files/60075040312.pdfIn PDF document text
    • https://812423.qqtogeljackpot2.com/contents/files/runuminufabajakagu.pdfIn PDF document text
    • https://www.die-umzugsfabrik.com/wp-content/plugins/formcraft/file-upload/server/content/files/16152438f696e7---bofovenifa.pdfIn PDF document text
    • http://noclegsosnowiec.pl/eurostyl/photos/file/20402990223.pdfIn PDF document text
    • https://gancza-yacht.pl/userfiles/file/18032763785.pdfIn PDF document text
    • http://mobilenmr.com/files/files/47080799461.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b069.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB069 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000c87b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC87B 15328 bytes
SHA-256: ed1e06e3aa54333451f47eccdff276f19e9dbe6e4665dfc104a5e55b2e924c14
font_02_sfnt_off0000ee80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE80 11272 bytes
SHA-256: 60e2edba41a3307cb4742ab6e8949c5078163d7a4ad49c2c52fefed6f907946a

Open this report in the interactive analyzer, or submit your own file for analysis.