Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c22bafd5e9bf0b4…

MALICIOUS

PDF

125.6 KB Created: 2021-03-18 03:19:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 17c701e555164dded3f99ed8504105cb SHA-1: f4dd1600e04bcf8eb281e1b1fc2f4378e0c10c97 SHA-256: 4c22bafd5e9bf0b4dc0027cdb271811216927757600a954a4aa2c4c7a7b276c9
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document was identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains a large number of external links, with many pointing to disposable hosting, suggesting a link farm designed to distribute malicious content or phish users. The presence of numerous external links and the ML classification strongly suggest an attempt to exploit users via redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=meade+lx200+8+gps PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4491669/normal_5fc9beab99c3a.pdfIn PDF document text
    • https://gaxezoxo.weebly.com/uploads/1/3/0/7/130776828/164a3acb2f.pdfIn PDF document text
    • https://wuluvaxezipow.weebly.com/uploads/1/3/5/3/135393263/kiponu.pdfIn PDF document text
    • https://tomosuboma.weebly.com/uploads/1/3/5/3/135382902/28323.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465392/normal_5ff03de158336.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402964/normal_60527f945c135.pdfIn PDF document text
    • https://kefobisow.weebly.com/uploads/1/3/4/7/134733217/zurupagufiwisa_lajotimunurego.pdfIn PDF document text
    • https://wudizabilizone.weebly.com/uploads/1/3/4/7/134745746/9871aea509a33.pdfIn PDF document text
    • https://velineninebag.weebly.com/uploads/1/3/4/6/134608195/gegenedabuneluwuxuvi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sowirutelevolur/clickup_time_tracking_report.pdfIn PDF document text
    • https://2b81f3f0-3f46-42ff-87a7-5865dd96cd3c.filesusr.com/ugd/fb41f9_185b1757964e4d8b9726f5c3c5832e4d.pdf?index=trueIn PDF document text
    • http://bukevixu.epizy.com/best_gift_for_teachers_day_in_india.pdfIn PDF document text
    • https://18b09f4e-de4d-4c1b-9fe6-be55c63b1c00.filesusr.com/ugd/cd81e9_3fd2d5b524824c4cb39011646f0a9fba.pdf?index=trueIn PDF document text
    • https://38f9ccf9-db33-4582-994d-0ea518e52d38.filesusr.com/ugd/368de4_0946d618aaa1408fbe956764167e504f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bufipevuril/12393920433.pdfIn PDF document text
    • http://bozolukiket.epizy.com/jaxijesi.pdfIn PDF document text
    • https://cb70cc59-2297-49c3-b7e2-2ac7e26e28d4.filesusr.com/ugd/4479ed_e3b598374f7045488968baff0a1654a0.pdf?index=trueIn PDF document text
    • http://lexalerov.rf.gd/10640752765.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e52d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE52D 67440 bytes
SHA-256: bf1dfa00798e6a7662a822381872ee2686853fe61c35ae3340d2604a02d9955f
font_01_sfnt_off0001aeff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AEFF 5572 bytes
SHA-256: 160f1b42f845ddd4b82ba7f5bdcf58c5433766a044f11269e2e044c93268329a
font_02_sfnt_off0001c211.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C211 11136 bytes
SHA-256: 149e0b94e0b4fb288b3f80fbcead0e16a4fc5492fad947e57e56e4167be9e643

Open this report in the interactive analyzer, or submit your own file for analysis.