Malicious PDF — malware analysis report

Static analysis result for SHA-256 4099797f6dc61f28…

MALICIOUS

PDF

81.6 KB Created: 2021-03-24 15:58:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 14f015db2b4727330fcce88723aa36bf SHA-1: f5edec78e6bf8042c979279dea45eb1df76bd4bb SHA-256: 4099797f6dc61f28c23c3c95078fa07bd2c28f6b1e46eb4f917cf55902a9bef2
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified as a link farm, directing users to various domains. The presence of a PDF_SEO_LINK_FARM heuristic and multiple unknown reputation URLs suggests a malicious intent to redirect users, likely for phishing or to download further malicious content. The ML classifier and ClamAV detection strongly indicate maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=meaning+of+business+venture+pdf PDF link annotation
    • https://cdn.sqhk.co/polidupokasu/jhdheZm/free_business_plan_template_for_cleaning_service.pdfIn PDF document text
    • http://gta-msk.ru/bekobogugowams14w.pdfIn PDF document text
    • https://cdn.sqhk.co/dafisuwikib/ijibgfH/wolf_theatres_greensburg_in_47240.pdfIn PDF document text
    • http://macsk.space/sokate8hf89.pdfIn PDF document text
    • https://cdn.sqhk.co/vibifexode/Oiaijjh/freeway_rapper_weight_loss.pdfIn PDF document text
    • https://cdn.sqhk.co/waxobakal/vhhYlgc/how_to_play_rummikub_number_game.pdfIn PDF document text
    • https://cdn.sqhk.co/lerapuraroke/ERTtieM/56232114497.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://332892e0-6a2b-40ad-946e-e7c92c61c867.filesusr.com/ugd/3e5d97_01bb09e1a96e42c2bb4a2a2ab363ef10.pdf?index=trueIn PDF document text
    • https://bb209e34-24c3-4901-88bd-c00af8cda710.filesusr.com/ugd/de6798_587d90e627814ecbae0e5f8af57bdc5d.pdf?index=trueIn PDF document text
    • https://571cbd0a-ba82-408d-be6d-2df53a8fcfe5.filesusr.com/ugd/02af14_7c5d7a22ca4944c789719489a30f57fd.pdf?index=trueIn PDF document text
    • https://170a7d3c-74f0-42f5-9ead-98ae292a4922.filesusr.com/ugd/a18aa6_a188aeb70c324834a9e387375080e553.pdf?index=trueIn PDF document text
    • https://3e3188f7-d9e9-48da-9af6-4e6760718ee0.filesusr.com/ugd/4f7562_2a5f3e058a584dda8951541a7f21a682.pdf?index=trueIn PDF document text
    • https://8ed7b8cb-9bae-4def-ad9b-66b28cd11f91.filesusr.com/ugd/740d8c_1a8f92f02357422a8fb6da5438efaf93.pdf?index=trueIn PDF document text
    • https://945c5b1a-9feb-4a08-b72d-c905ca1b1520.filesusr.com/ugd/27135d_963376559d204284b9e7c0de2df79791.pdf?index=trueIn PDF document text
    • https://7aff118d-26f6-4d76-9bc9-1838009e7274.filesusr.com/ugd/f80014_20446176016846a182913ca874683836.pdf?index=trueIn PDF document text
    • https://1d64308e-dc5a-4449-a553-acfd6b34bddc.filesusr.com/ugd/28b3f7_d30805d400ce404e8502c5d75cc050b4.pdf?index=trueIn PDF document text
    • https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_6cf206e86bbc4ff88ecc9462efcaadb7.pdf?index=trueIn PDF document text
    • https://aaf8962b-2ea5-4403-bfea-7c32f2b3f77e.filesusr.com/ugd/8f3a65_8f310766c9824dfc9cbae0fd586154e3.pdf?index=trueIn PDF document text
    • https://0502d5d0-a0f5-47b8-bc1c-644c46e4e431.filesusr.com/ugd/6cabbb_71023436ff724ee4a07a1b9aaee5a009.pdf?index=trueIn PDF document text
    • https://a8a2d6b8-6248-42a0-90a4-e25e421c2e59.filesusr.com/ugd/f63f29_392669f677e142a386609e3bc0d8e144.pdf?index=trueIn PDF document text
    • https://33edd578-4186-4695-89f3-f56a5a23fc53.filesusr.com/ugd/f17c08_2b08ffdedb33423fb67ce831d6069401.pdf?index=trueIn PDF document text
    • https://b23ebcb4-2e41-4c68-a408-584c84124782.filesusr.com/ugd/5a2446_5497833be41246358e7637a157376986.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f442.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF442 5264 bytes
SHA-256: 84369c536a6862c49252fc130e50c85b65700c5d9a1799628b6bc73b72417236
font_01_sfnt_off00010639.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10639 10788 bytes
SHA-256: 5f36bb6a2b161dd5623c2325fb0ab0a265abcf0cac463f54c065e48852cf51af
font_02_sfnt_off00012b1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B1E 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.