Malicious PDF — malware analysis report

Static analysis result for SHA-256 38142caba165facd…

MALICIOUS

PDF

74.8 KB Created: 2021-03-29 22:06:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 6b0ee5800257a85216841decb9e3a89c SHA-1: 3bc330885f3b5ac5c5f81467e953748610d15e55 SHA-256: 38142caba165facd4e785ab34f8182d9e08cbb6754fd405c3d8a431a37759a75
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=spiritual+meaning+of+yellow+in+the+bible PDF link annotation
    • http://pusovemolexed.scienceontheweb.net/panasonic_exhaust_fan_catalogue.pdfIn PDF document text
    • http://jonipifenukiz.mygamesonline.org/africa_twin_dct_manual.pdfIn PDF document text
    • http://rumurel.mywebcommunity.org/himno_nacional_de_honduras_con_las_7_estrofas_letra.pdfIn PDF document text
    • http://zotoxilob.getenjoyment.net/gisometujebifimudonu.pdfIn PDF document text
    • http://naxiramomamaz.66ghz.com/putovobokulana.pdfIn PDF document text
    • http://remalizaf.iblogger.org/12874316027.pdfIn PDF document text
    • http://xujofalidubof.iblogger.org/vamironimubipor.pdfIn PDF document text
    • http://kiritisivasol.mywebcommunity.org/medians_altitudes_and_perpendicular_bisectors_worksheet.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://pepebejawu.epizy.com/41075492769.pdfIn PDF document text
    • http://lumawasisoxo.rf.gd/wofapamewuju.pdfIn PDF document text
    • http://feferabi.atwebpages.com/ropavamajuxuzofavegigemob.pdfIn PDF document text
    • http://sulunaza.epizy.com/animal_husbandry.pdfIn PDF document text
    • https://737bf953-b780-43bc-8af0-312ed5328a40.filesusr.com/ugd/017c44_c0efc0ebe2684e91a288a934123b420c.pdf?index=trueIn PDF document text
    • https://ad177677-9664-42cd-9bf2-17a10eef6e1d.filesusr.com/ugd/f8915e_a859092d206240cc8264d1e5c8c526bc.pdf?index=trueIn PDF document text
    • http://zagofij.onlinewebshop.net/the_merchant_of_venice_bassanio_character_analysis.pdfIn PDF document text
    • http://pisogeb.rf.gd/burris_fastfire_2_manual.pdfIn PDF document text
    • http://zaduzos.myartsonline.com/adobe_reader_free_download_for_windows_xp_64_bit.pdfIn PDF document text
    • https://fa202315-5cd5-4006-9a99-7c5d4406650e.filesusr.com/ugd/61804c_6c3b760eba184681ad3c043f8ce03d79.pdf?index=trueIn PDF document text
    • https://7afcd0b8-98df-42a4-afe0-9544d44c9539.filesusr.com/ugd/74e9cf_fd811818dfdd4e1a920caa1c7bf6ecf2.pdf?index=trueIn PDF document text
    • https://cda84be5-0c54-4c05-8389-97bb004c798d.filesusr.com/ugd/fa9f00_565c5f2e498a40c9bed30edc819c53db.pdf?index=trueIn PDF document text
    • http://tuzibepunu.rf.gd/frenchpdf._com_alter_ego_a1_manuel.pdfIn PDF document text
    • https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_81604843e7b847b9a1d876cef1844e90.pdf?index=trueIn PDF document text
    • https://3ae4d138-4ba3-4962-98fb-1b98b40a6a82.filesusr.com/ugd/38062a_5eb807e9b56649a19da5ed57853cfa27.pdf?index=trueIn PDF document text
    • https://050a9d39-d8a1-4107-8be8-b2b70b72e454.filesusr.com/ugd/5262df_0e0882381635494291ca24e5c35a91f4.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e730.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE730 5572 bytes
SHA-256: 70ec14e9c469c0c38ec61825558f5ebd50b69dd40037d4deb7cf63a1292d1491
font_01_sfnt_off0000fa11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA11 10432 bytes
SHA-256: 3bd42b4c0ca54cc34411995cdaeae7f5a198de7df8d66088fec9168aa99f68ca

Open this report in the interactive analyzer, or submit your own file for analysis.