Malicious PDF — malware analysis report

Static analysis result for SHA-256 47a24285e5e90a5b…

MALICIOUS

PDF

89.6 KB Created: 2021-05-20 02:05:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: a12614c3660dd30540e7373d9f3d4ea4 SHA-1: 218f70647e83ca0f2581132dacd750925d751ca3 SHA-256: 47a24285e5e90a5be5de27444ee3314f8b02ce3799c3da978846baa6e58aec6c
196 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to SEO redirectors and potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' and 'PDF_SEO_UTM_REDIRECTOR_LINK' heuristics. The primary malicious URL identified is 'https://kuzutuzo.ru/strik?utm_term=what+are+different+types+of+wattmeter', which is likely used to host phishing content or distribute further malware. The ML classifier and ClamAV detection strongly support the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=what+are+different+types+of+wattmeter PDF link annotation
    • https://dulewexafup.weebly.com/uploads/1/3/4/7/134702005/4703696.pdfIn PDF document text
    • https://dadekubezaxinis.weebly.com/uploads/1/3/2/7/132740399/tozufe.pdfIn PDF document text
    • https://petenugilamabo.weebly.com/uploads/1/3/1/4/131453278/7aba61564591c4.pdfIn PDF document text
    • https://mawikimame.weebly.com/uploads/1/3/4/2/134235565/3192123.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/d84632af-a9b9-45b8-9994-cf731e390a4c/85866472669.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fbcf8008-eb2c-4798-8989-f57f37bb7763/xupojopa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a668951-5a2e-44b2-9441-a6bc9ef8c1a6/kokodufabudexe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91262a2c-eb88-4a48-a4cd-2fc3d32cc07c/baridotajebipiwugojigupi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0db85e25-e102-4d50-8295-78c89d8d8ea3/shark_rotator_powered_lift-away_truepet_bagless_vacuum_nv752_filter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1490095-e861-46c2-8ce4-4ffab0e2e395/how_to_bleed_power_steering_chevy_impala.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c6daeac-8db5-4c5f-9aab-67c62f67f469/dyson_dc59_filter_removal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60a78a48-793f-4007-ac34-950e4da0a02e/65101883477.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40eb53ec-3e54-4049-b818-00b51a1ca15e/vifafesawa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66d78139-11fe-4321-967b-4859021110ff/foster_child_life_book_templates.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/725692a0-8682-433f-958e-b3eebed38ab6/what_to_do_if_you_have_lost_a_school_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3b84a61-b60c-4187-8edf-9ba50544ea00/v._what_are_the_five_stages_of_team_development.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25b0ceeb-6d41-4e95-8ba7-272ba8f99d72/69805992581.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b930a69e-4423-47c5-b7f5-fa723b8bf205/10_knots_to_nautical_miles_per_hour.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ca35565-5f82-42da-8ad1-5a8a5b1a81b7/ligibotuw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA10 5244 bytes
SHA-256: a67d0ccb0db7e1b58821e2ccbbde5f19aad885344da3d526d49b128085338a72
font_01_sfnt_off00010bd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BD2 12160 bytes
SHA-256: 1069afd3d64e83af016e074fa875fb3d6c8da493021740702b515b3c748895df
font_02_sfnt_off00013519.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13519 16244 bytes
SHA-256: e208d6fa2ecc1ee8b98dd0bd1684ffb5e3891779cf61ffdb9cb439440ba08a20
font_03_sfnt_off00014a88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A88 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.