Malicious PDF — malware analysis report

Static analysis result for SHA-256 3830e9d1ccb5be30…

MALICIOUS

PDF

90.6 KB Created: 2021-03-15 17:52:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: a5211bc4b89b09ab0d693b30498e5d0a SHA-1: ddc0d086443d2d115b03433f1b1b238b19e81c80 SHA-256: 3830e9d1ccb5be304e3cc974e2dbe8a54056d73fa9d8569b1c24659f5d9fe7a7
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of a 'download button' heuristic further supports the idea that the document is designed to lure users into clicking links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=worldfree4u+bollywood+movies++hd+2014 PDF link annotation
    • https://cdn.sqhk.co/fuvebopeweb/EcD7ie2/rokosibag.pdfIn PDF document text
    • http://jafoxidulez.mypressonline.com/53108747956.pdfIn PDF document text
    • https://cdn.sqhk.co/jukelifawap/iDMghid/snake_in_the_grass_country_song.pdfIn PDF document text
    • https://cdn.sqhk.co/wabajevebe/3gdshiZ/ding_dong_music_lyrics.pdfIn PDF document text
    • http://vitonidero.medianewsonline.com/timifabolisededatu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/zulezov/75215516538.pdfIn PDF document text
    • https://6f12065f-c45d-410c-b048-6ec23fb2b810.filesusr.com/ugd/02ccf7_3aec4163e01d47a183e74637db709696.pdf?index=trueIn PDF document text
    • https://36425c1f-c329-48aa-845d-1f8252cb45c8.filesusr.com/ugd/01d500_bdf18915b7f74a10ab22b24ccf3241e7.pdf?index=trueIn PDF document text
    • https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_9771b0d388784441893069574302c252.pdf?index=trueIn PDF document text
    • https://07e0a16e-b77d-475b-b724-88bbaedb347c.filesusr.com/ugd/8e9e2f_62ffe6cf9b93482b8854c5c50bd577d2.pdf?index=trueIn PDF document text
    • https://e9593579-f51f-4dc6-af55-2543ab512b45.filesusr.com/ugd/37952c_e1539aa81b944825b23cbd2d85d317a1.pdf?index=trueIn PDF document text
    • https://9f53eded-325d-4e02-8430-7c09bd872488.filesusr.com/ugd/e04405_9aed918619334d4a93967ca8509492be.pdf?index=trueIn PDF document text
    • https://7d40d8d4-2a5c-4bfc-85f5-4808a9c864d7.filesusr.com/ugd/e745be_8df2ea531d6e4e748bc5c6936f82e5ad.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bomupi/7960315942.pdfIn PDF document text
    • http://nujilexulajuwup.atwebpages.com/archaeologies_of_landscape_contemporary_perspectives.pdfIn PDF document text
    • https://a49a6154-edc8-4132-95a2-c7bb8d673fe9.filesusr.com/ugd/551169_7453a23205d14bfb94374dd5c85e7b39.pdf?index=trueIn PDF document text
    • https://c7f0abc7-d23b-482d-bd16-0771495bb668.filesusr.com/ugd/bb13a2_a31f9899ce244f348cc020d2773a57ea.pdf?index=trueIn PDF document text
    • https://dda5c79a-a75d-44d9-a006-48dec3bfe172.filesusr.com/ugd/115d6e_66a9e16dd6144a7a842af8f08a4f8442.pdf?index=trueIn PDF document text
    • https://3ae4d138-4ba3-4962-98fb-1b98b40a6a82.filesusr.com/ugd/38062a_58bc4c3ed5bf41bdb7ff4563b22df32d.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000111a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111A2 5456 bytes
SHA-256: 4628ede0223b745e182392988e63ba59240eaeb896bd81b6d6d4e6f01521c0a3
font_01_sfnt_off00012456.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12456 12512 bytes
SHA-256: b16005597793cae5c11f662e988a8e31239e86695bef4890bd6f81de75ee1183
font_02_sfnt_off00014ee6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14EE6 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.