Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d0f2d28cfb3f8dc…

MALICIOUS

PDF

74.6 KB Created: 2021-03-13 20:00:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 2727a0993565183b79b71662abaa26bf SHA-1: 537c83235f245c517930177e77c1e796ff41879c SHA-256: 3d0f2d28cfb3f8dce1ea06572b088f503dbd50df23b9ad2c0bffb1e0b6829fc1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=auto+clicker+roblox+dragon+ball+rage+android PDF link annotation
    • https://bimuwosexiwo.weebly.com/uploads/1/3/1/1/131164043/vijigisepazidakakare.pdfIn PDF document text
    • https://daliroxemonove.weebly.com/uploads/1/3/0/7/130775241/9713646.pdfIn PDF document text
    • https://zasevolonuto.weebly.com/uploads/1/3/5/3/135335071/4586857.pdfIn PDF document text
    • https://xarirutufe.weebly.com/uploads/1/3/4/6/134659575/wimulukiw.pdfIn PDF document text
    • http://berabufepibaj.iblogger.org/bajugavunuxifirafosij.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kikunojulejuj/how_to_adjust_speed_on_club_car_precedent_gas.pdfIn PDF document text
    • http://fokafupu.rf.gd/european_journal_of_emergency_medicine_case_report.pdfIn PDF document text
    • http://rogofijanititad.epizy.com/13323129479.pdfIn PDF document text
    • https://s3.amazonaws.com/sesijesule/29396608657.pdfIn PDF document text
    • http://milojomalodomu.epizy.com/convert_file_to_editable_word_document_online_free.pdfIn PDF document text
    • http://sasilefup.rf.gd/cahier_des_charges_informatique_exemple.pdfIn PDF document text
    • https://s3.amazonaws.com/juvosi/xasaj.pdfIn PDF document text
    • https://s3.amazonaws.com/lorugipopuxe/81064623101.pdfIn PDF document text
    • http://jezopemezirixo.rf.gd/traditional_approach_to_conflict_management.pdfIn PDF document text
    • http://nibijebe.epizy.com/serway_vuille_college_physics_9th_edition_solutions_manual.pdfIn PDF document text
    • http://nilevividik.rf.gd/kitanujika.pdfIn PDF document text
    • http://sujuletabekomus.rf.gd/federer_book.pdfIn PDF document text
    • https://s3.amazonaws.com/fopalew/82532445249.pdfIn PDF document text
    • http://vugoban.epizy.com/learn_spanish_for_free.pdfIn PDF document text
    • https://s3.amazonaws.com/zibenoroduzuw/tone_it_up_protein_bars_target.pdfIn PDF document text
    • http://woxanegerofokox.rf.gd/beposibiniloromepado.pdfIn PDF document text
    • https://s3.amazonaws.com/lurutopobi/80645906795.pdfIn PDF document text
    • https://s3.amazonaws.com/xixonu/98877807033.pdfIn PDF document text
    • https://s3.amazonaws.com/nimuwet/kamiluter.pdfIn PDF document text
    • http://susijul.rf.gd/vutaketomun.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e25b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE25B 5188 bytes
SHA-256: f24fa32fd565b9293d7d337a91ae1ab9dcc4c3a218b7e57bed39c5596df34e63
font_01_sfnt_off0000f411.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF411 11420 bytes
SHA-256: 894ce37ff837599477225894a26f3bc9cfaa6dbb5589ce87b953ebeae25076d9

Open this report in the interactive analyzer, or submit your own file for analysis.