Malicious PDF — malware analysis report

Static analysis result for SHA-256 4bcd7187e610c15a…

MALICIOUS

PDF

78.5 KB Created: 2021-05-26 15:51:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 96fac80e26c76baa263aa2cb1ee093f8 SHA-1: 26cc455776d077101754604e34a42c8f692c9930 SHA-256: 4bcd7187e610c15af115e572328c62f2fa5a5f1b6da7ca495c3d864e3c457cfe
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by both ClamAV and an ML classifier. It functions as a link farm, containing numerous external URIs that point to various websites, including one with a 'utm_term' parameter suggesting a phishing or SEO manipulation attempt. The presence of many external links on disposable hosting indicates a likely attempt to redirect users to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=the+division+2+shield+build+reddit PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4374852/normal_5fe6ac9519391.pdfIn PDF document text
    • https://weziriditovi.weebly.com/uploads/1/3/4/1/134108838/ab248dbc8399.pdfIn PDF document text
    • https://kazowotamije.weebly.com/uploads/1/3/4/0/134012594/2595901.pdfIn PDF document text
    • https://zusikoxapumobib.weebly.com/uploads/1/3/4/7/134766975/tuzefezaz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447433/normal_606479cdc2b29.pdfIn PDF document text
    • https://vesifumami.weebly.com/uploads/1/3/5/2/135294942/kubotizowuruji.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477615/normal_600b6e03dd6b2.pdfIn PDF document text
    • https://radamokugek.weebly.com/uploads/1/3/2/6/132696621/bowimasofisaxuragodu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388420/normal_6063e8555c46c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413012/normal_60484f0f8ef39.pdfIn PDF document text
    • https://pulapafux.weebly.com/uploads/1/3/0/8/130874232/5129b3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/134f8a26-a18a-4ec0-843f-d17e2f72bb06/feliz_navidad_song_meaning_in_english.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c9ad280-2d91-4811-8584-fd9c6bc01a33/realtek_high_definition_audio_driver_for_windows_7_32_bit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dcece965-c418-4bb4-9b27-60810fa7c25b/97901554392.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ddf991f9-6dd5-4475-9b0a-bfb4f62272ec/what_is_a_ice_sculpture_made_of.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/403f3c2c-dbe1-4977-9462-3dcee12756f9/37277470406.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a72fba3-2042-466d-98e4-81398cbcd988/spectrum_remote_control_code_for_vizio_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5d07575-3528-4d10-b08f-22324efab61d/52698286903.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ecf26b3f-1976-4e9b-9ef6-26d28fc0b491/how_to_unlock_alcatel_lucent_phone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca58d5b3-30e3-48e0-bc59-ffb4e553f0ce/can_you_be_a_navy_seal_if_you_are_a_woman.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5b116a4-594a-43aa-aba8-64aef436c255/yamaha_rx_v475_firmware_1.30_nderungen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6fa05ba-27b6-4885-b79e-1323f4f93277/vokiwal.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9A0 4984 bytes
SHA-256: 7e06411da83bff88a78a28a4b8c54ce76cf0409606d5d8997d3639ecf9259344
font_01_sfnt_off0000fa86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA86 2528 bytes
SHA-256: fe2123dbee4b7bf8755342d2f8fb97f76f6a70077f8b9fc3a8343a1737165214
font_02_sfnt_off000105b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105B7 11504 bytes
SHA-256: 2dad5c8cf2584f10dd0bd33d480a11a550c2981437f6c46badfbd0d9cadbe6c0

Open this report in the interactive analyzer, or submit your own file for analysis.