Malicious PDF — malware analysis report

Static analysis result for SHA-256 38ad39dde3be76b9…

MALICIOUS

PDF

84.8 KB Created: 2021-04-12 01:25:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 3047efde82a05bd26d8e4996737c58fd SHA-1: 7ec69db4cbf6638ad571e90c5cb4d94e41f5c236 SHA-256: 38ad39dde3be76b98d35117a00a4d00f795b0353246644e1c4e3446c8a626a1c
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file contains a large number of external links, identified as a link farm. The primary malicious URL is https://mezovuduw.ru/strik?utm_term=hayward+heatpro+fault+codes, which is likely used to distribute further malicious content or for SEO manipulation. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=hayward+heatpro+fault+codes PDF link annotation
    • https://redobalopubijav.weebly.com/uploads/1/3/1/3/131380120/5ed1a81a29.pdfIn PDF document text
    • http://amandeepsadyora.com/3_billy_goats_gruff_teaching_ideasidg4l.pdfIn PDF document text
    • http://vas-rem.ru/pergamena_di_laurea700w0.pdfIn PDF document text
    • http://findssldz.xyz/conexant_hd_audio_driver_windows_10_dellfzsyt.pdfIn PDF document text
    • https://nezogifoxo.weebly.com/uploads/1/3/1/6/131637357/pekafinirapig.pdfIn PDF document text
    • http://womotov.22web.org/xagewafefavu.pdfIn PDF document text
    • https://rifubagozoj.weebly.com/uploads/1/3/2/6/132695416/borezotanos_ravivarer.pdfIn PDF document text
    • http://iminn.ru/the_good_girls_music_group9z51c.pdfIn PDF document text
    • http://vashastrahovka24.ru/12698305799xodi2.pdfIn PDF document text
    • http://all-gopro.com/administracion_financiera_fundamentos_y_aplicaciones_oscar_leon_garcia_gratisup5ws.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kiwopusafize/72052541619.pdfIn PDF document text
    • http://jasazovi.rf.gd/appalachian_trail_map_tennessee.pdfIn PDF document text
    • https://35e1cc1d-5f6c-4a41-9b1b-b9ae8dddc97a.filesusr.com/ugd/351eee_e906dbe37b554f88a6a21bbebb782969.pdf?index=trueIn PDF document text
    • http://jijekoseme.epizy.com/74721685519.pdfIn PDF document text
    • https://bff5fdab-9fd0-4670-908b-a1308bb5a9cb.filesusr.com/ugd/227d0f_8fe06507d25940879f791c85154e4c1b.pdf?index=trueIn PDF document text
    • https://2d130471-2a64-48ba-87cf-8f1e86c6acad.filesusr.com/ugd/9c43ec_25a09d5ad4b749e28767a616eac8c050.pdf?index=trueIn PDF document text
    • https://0ef2f354-78a3-4528-990c-72f69c86fc6a.filesusr.com/ugd/6a0da6_c553ccf3c3814d2b8e89199f90894ba2.pdf?index=trueIn PDF document text
    • http://faxipobusevive.rf.gd/88688013239.pdfIn PDF document text
    • https://s3.amazonaws.com/bulozor/appcompatspinner_example_in_android.pdfIn PDF document text
    • https://s3.amazonaws.com/nuxulikiwab/kafuronabaz.pdfIn PDF document text
    • https://s3.amazonaws.com/rijaliwiguvex/dozalazuxojosa.pdfIn PDF document text
    • https://7e19c1c2-6675-4e4d-baed-802c948efb6e.filesusr.com/ugd/e5a943_655cef60cc564b90888b17a08989c939.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e96a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE96A 5396 bytes
SHA-256: 7046828e8ab42cfd32a37101ee8566469f1f3cc8cebb39479e81346638638016
font_01_sfnt_off0000fbd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBD3 2580 bytes
SHA-256: 255c2434387a63b4c800821f7953b8186e35400b86fd552033c84d665cea77b5
font_02_sfnt_off000106cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106CB 11264 bytes
SHA-256: fed077de4b7a5af041d21f69e8b3538d9509664bcacdea2219e00290f23da31b
font_03_sfnt_off00012d7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D7D 16300 bytes
SHA-256: 8b46b8240bb194b89670d434f8c01d49dd48dbcf49f9fffc3084d623f34acbd0

Open this report in the interactive analyzer, or submit your own file for analysis.