Malicious PDF — malware analysis report

Static analysis result for SHA-256 512342cd56997d46…

MALICIOUS

PDF

75.5 KB Created: 2021-03-27 22:26:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: e6fb3ac57364e2d86b5fae53e15daaa0 SHA-1: 1587b10ab72c1dd9c0383ada72777c17eafbc7a6 SHA-256: 512342cd56997d469c92e19ae104a39d15c7d2c77a370fed8e67ee77fef34b65
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=lukas+graham+once+i+was+7+years+old+lyrics PDF link annotation
    • http://dutov.org/what_is_a_house_blessing_ceremonyvjtoz.pdfIn PDF document text
    • http://bupetud.xyz/9228192914m0lay.pdfIn PDF document text
    • https://tebukebodo.weebly.com/uploads/1/3/1/3/131381901/xisenajolevi_loxiwosogaf.pdfIn PDF document text
    • https://ponozivodu.weebly.com/uploads/1/3/0/7/130775347/3724655.pdfIn PDF document text
    • http://sodaapp.pro/30161113592w2qgg.pdfIn PDF document text
    • http://itmax.info/bobby_deol_movie_badal39hoc.pdfIn PDF document text
    • https://bodadesoka.weebly.com/uploads/1/3/4/2/134234706/jeduzedefirotili.pdfIn PDF document text
    • https://sadijamozu.weebly.com/uploads/1/3/0/8/130814559/4049779.pdfIn PDF document text
    • https://wetusaseri.weebly.com/uploads/1/3/5/2/135297966/givijezilamox.pdfIn PDF document text
    • http://ipai.online/89459189655fokh1.pdfIn PDF document text
    • https://fupakedozoj.weebly.com/uploads/1/3/1/4/131407080/guxirewanamef.pdfIn PDF document text
    • http://pesale.pro/still_i_rise_poem_symbolismqw1hl.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://24d1f61b-f5c5-4d2f-8180-62589f44e8d8.filesusr.com/ugd/eed56f_7b0a5b2b2f414481b756509830be5333.pdf?index=trueIn PDF document text
    • https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_3ed28d906cbc4939a04ab0b788f5d788.pdf?index=trueIn PDF document text
    • https://d56a38bf-d62e-453c-9b5b-5b2fe88aea46.filesusr.com/ugd/359e64_ae15e1f6cbb14b1c931f8093c2a7d205.pdf?index=trueIn PDF document text
    • https://0a38098d-26c8-4844-ab0b-2dfc398d7f8d.filesusr.com/ugd/fffd55_878285c91a7b41b2b24c8479e4245842.pdf?index=trueIn PDF document text
    • https://8d928d4c-4e32-4dc6-8093-d383c90b3cca.filesusr.com/ugd/b5d49c_b9fb76ff0c7e44b58a887fc96c33ff78.pdf?index=trueIn PDF document text
    • https://ad177677-9664-42cd-9bf2-17a10eef6e1d.filesusr.com/ugd/f8915e_13f7e3d5e1d54a7c84655f0034ec2858.pdf?index=trueIn PDF document text
    • https://2386e270-bd20-42c1-b3e5-1ba7eaa1d68d.filesusr.com/ugd/b4f0c6_27b2ff718e7f4b7ebe5500201ec1c174.pdf?index=trueIn PDF document text
    • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_07452a852fc440d6a4c08eeb8f7a7010.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB03 5632 bytes
SHA-256: 4be362e274f7fe888f280e559c2b0fd870a9cbaa2b67a4f7ec48e95a15858298
font_01_sfnt_off0000fe26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE26 10064 bytes
SHA-256: 28e4e2609361524a86687181f985b62331da4a1a3aa5c5763012142d98468a71

Open this report in the interactive analyzer, or submit your own file for analysis.