Malicious PDF — malware analysis report

Static analysis result for SHA-256 51a049640fcb0ff9…

MALICIOUS

PDF

88.8 KB Created: 2021-03-20 00:25:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: ec3e062c3b7f6eb062af1725a582ef33 SHA-1: 7e2891d0e26547b50645923bb6a3d5f7882e080f SHA-256: 51a049640fcb0ff93704f9d6cd38014d8b4ab00ec5e2d533fac9564938571f82
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by multiple heuristics and a machine learning classifier, with ClamAV detecting it as Pdf.Phishing.Trojan. The file contains a large number of external links, many pointing to disposable hosting services, suggesting a link farm or SEO manipulation tactic. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic indicate an attempt to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=accrington+train+station+platforms PDF link annotation
    • https://jubagidegugidok.weebly.com/uploads/1/3/5/3/135317658/2002792.pdfIn PDF document text
    • https://cdn.sqhk.co/radofufalam/phhgihc/camera_app_for_android_free_download.pdfIn PDF document text
    • https://wipegozi.weebly.com/uploads/1/3/0/9/130969535/gobudetumukexujeru.pdfIn PDF document text
    • http://temivenoni.iblogger.org/android_tv_box_remote_manual.pdfIn PDF document text
    • https://woxukobu.weebly.com/uploads/1/3/4/3/134392577/33035.pdfIn PDF document text
    • https://kipopidetudi.weebly.com/uploads/1/3/1/4/131407440/votunotute-dajimiko.pdfIn PDF document text
    • http://momarivido.mypressonline.com/set_associative_mapping_in_cache_memory.pdfIn PDF document text
    • http://gepexoliv.medianewsonline.com/53443310113.pdfIn PDF document text
    • https://regagilozot.weebly.com/uploads/1/3/1/8/131871395/dewaxuvogavejese.pdfIn PDF document text
    • https://cdn.sqhk.co/juxezijafoz/iifkj0D/raleradazudexowe.pdfIn PDF document text
    • https://cdn.sqhk.co/zatanolivog/jgerifq/invitation_to_an_event_email_template.pdfIn PDF document text
    • http://sdfsdfsdf.shaketorch.com/gofiwuma.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://30d6ba4c-d201-4e26-8f31-a0e059b28788.filesusr.com/ugd/f9b8bb_ddf4dbfc865a4e35aa67dfca1ea900ee.pdf?index=trueIn PDF document text
    • http://wawopuviginase.epizy.com/xemumovufonis.pdfIn PDF document text
    • http://wolaxagemir.rf.gd/xifazimudiba.pdfIn PDF document text
    • http://wurebosuloxu.myartsonline.com/tamilnadu_tet_answer_key_2020_download.pdfIn PDF document text
    • https://a9864912-ad24-422b-99f3-2d90f7703507.filesusr.com/ugd/d6af85_0b7461162daa4408b321321b91b680ed.pdf?index=trueIn PDF document text
    • https://1ffb5d6c-d890-49e0-9b87-dc10fbfa49e2.filesusr.com/ugd/8bc2a6_7093ebf4078e439dafb143b23e427090.pdf?index=trueIn PDF document text
    • https://ec2d952e-5494-46d8-b841-fee222248b17.filesusr.com/ugd/9713d5_4270e1b609c84d94ac8411e54864f8ae.pdf?index=trueIn PDF document text
    • https://e7f45dcf-1957-410e-85b1-216e85a225c4.filesusr.com/ugd/a2c2bc_14b36a3ca51843c0a4e7301559ea7c6d.pdf?index=trueIn PDF document text
    • https://cb8582fb-ab29-4f13-bfd4-623ca244ab52.filesusr.com/ugd/d61b30_6640ad2de3fa4525b03531eb4137e1d4.pdf?index=trueIn PDF document text
    • https://f8b2de7a-6012-4721-b8f1-df5267d6bb95.filesusr.com/ugd/8ebb60_a65262baee2d4bf2a93b7e46dff57277.pdf?index=trueIn PDF document text
    • https://4b4ea461-5266-411b-8735-d5290551f550.filesusr.com/ugd/7fedcf_aab062ec462446569dfea8eff98195bd.pdf?index=trueIn PDF document text
    • https://3745348a-78a0-42d7-8ff4-af2b45bf5faf.filesusr.com/ugd/02631b_cfe89f62d6d44f3c96e3ae68ea86c819.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011c18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C18 5324 bytes
SHA-256: 2d47aea1701ff409ddc09a4d4c6207f2558f2cb862eba0ab9d2bc1bdabca68b1
font_01_sfnt_off00012e26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E26 11808 bytes
SHA-256: cc9acca862373b998344411ae95556f6a7ae7d5b44f70f83ecbd3b5c765c7b92

Open this report in the interactive analyzer, or submit your own file for analysis.