Malicious PDF — malware analysis report

Static analysis result for SHA-256 4065c94b8508e2f0…

MALICIOUS

PDF

93.9 KB Created: 2021-04-28 10:05:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 63ff2558226a6bdfb2f94e019afa9da2 SHA-1: 949b7b92e03f40050caade199245012bf50fe670 SHA-256: 4065c94b8508e2f0fcb01d652242be4a1364f67db046df3f203197f1070ac0eb
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO spamming operation. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect users to malicious sites or download further payloads. While no scripts were explicitly extracted, the PDF structure and heuristics point towards techniques used for obfuscation and redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9850

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=how+to+set+the+time+on+a+casio+g+shock+wr20bar PDF link annotation
    • http://baltika-trans.com/31807120804kfruh.pdfIn PDF document text
    • http://weinmvc.net/gevurzqfa8.pdfIn PDF document text
    • http://jilet1.club/focusrite_saffire_pro_40_driverc4yj9.pdfIn PDF document text
    • http://wavokumad.iblogger.org/80015242766.pdfIn PDF document text
    • http://snegny.com/borusotig5pz3m.pdfIn PDF document text
    • http://sale50.pro/248534708440ewfs.pdfIn PDF document text
    • http://ridegibulas.22web.org/mathematical_modeling_tutorial.pdfIn PDF document text
    • http://fitojijumuta.22web.org/audit_report_of_reliance_industries_2020.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rigozapovi.epizy.com/bixagaranowuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09fd7979-b484-4de1-9e9a-c2f9a8e5bf67/district_of_columbia_form_d-30_instructions.pdfIn PDF document text
    • https://5a8aee2d-3d68-4c09-98ed-743c9c56d6fd.filesusr.com/ugd/460efe_5b74f06ef60a40019438bb7023466410.pdf?index=trueIn PDF document text
    • http://wivifizurata.epizy.com/91180201890.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98cf4c43-ceb0-4739-87f5-0be6c8c4f5b2/what_food_makes_you_put_on_weight.pdfIn PDF document text
    • https://d25e5d79-f3dc-43ab-8538-58f2f4730235.filesusr.com/ugd/898300_70811c1a08f44a30b2620f6d666d7f84.pdf?index=trueIn PDF document text
    • http://kojawuze.epizy.com/libros_sobre_alcoholismo_y_drogadiccion.pdfIn PDF document text
    • https://4c2674ec-1430-4cec-a455-d6a35d10586e.filesusr.com/ugd/38955b_59805cb5363f4c88ac7b71e90ec32798.pdf?index=trueIn PDF document text
    • http://nesasodatujor.epizy.com/converting_kindle_format_to.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c341fcae-8d24-493e-917f-ed89e1b58f1b/tuck_everlasting_quiz_chapters_1-5.pdfIn PDF document text
    • https://35479656-6a94-44d6-ac55-da507c14a2ae.filesusr.com/ugd/d68318_8e43aab566d2469aaa1ed46ed333491c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7308f924-3e4e-486a-b547-7c26a242822c/zayn_book_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89ec11ea-d407-4999-81d7-321b568c7b3b/adobe_photoshop_cs5_crack_amtlib.dll.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66a59e76-2e5b-4487-b29a-54294167523c/when_to_do_hand_mudras.pdfIn PDF document text
    • http://jalugegaru.epizy.com/baby_around_the_world_game_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee51de37-e9fd-47ae-a90e-7a73de9d1dd7/56014050713.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5568d372-ecba-4cf7-be19-214a880cb195/how_to_change_font_size_on_brother_p-touch_1880.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48bfb0e6-6804-4d04-8d2b-76c4db7a76e6/toro_20332_lawn_mower_reviews.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7BC 6416 bytes
SHA-256: 528d1e79c27aec131c2cbf846536b85f4c117e3725d0fa982f5a85159cdab222
font_01_sfnt_off0000f78e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF78E 5712 bytes
SHA-256: 95f5bb5c888a5242d4ff7a4044923040d21e43b502a9fb9442f0693581e19740
font_02_sfnt_off00010acf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10ACF 8548 bytes
SHA-256: 2ff94f93d526137035a21f95c35331d422b5c7f22a8e655f5506f2b62eafe879
font_03_sfnt_off00012665.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12665 10060 bytes
SHA-256: 0e12e5bfd65fa646ad8296c12e55d2eec7b67a86efdf11a41bd3ca579298d8eb
font_04_sfnt_off00014933.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14933 16256 bytes
SHA-256: 8cc6bcc2cf3defe0a88aedbd81e1c3d6ddceaf294630c8a268e5b6d92b2eedfb
font_05_sfnt_off00015e90.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15E90 1736 bytes
SHA-256: 0d9b6ab0354368cdfa5a4e52e4dfb250ede80cec4283e48fafec0a3c1c1d30df

Open this report in the interactive analyzer, or submit your own file for analysis.