Malicious PDF — malware analysis report

Static analysis result for SHA-256 52faf6654ddc250d…

MALICIOUS

PDF

81.7 KB Created: 2021-05-15 15:30:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 859fbb2af4b659a2f41b3d80e52b9c94 SHA-1: 9738c9277f581924e4c13184a954ea79d3b546a8 SHA-256: 52faf6654ddc250d4cf65bdc16277d42980c1ecfcfc5e3bf9413ea4cfb3371d4
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristics reveal it functions as a link farm, directing users to numerous external URLs, one of which is `https://pelibifir.ru/strik?utm_term=5+out+offense+vs+zone`. This behavior is consistent with phishing or SEO manipulation tactics, often used as an initial access vector via spearphishing attachments.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=5+out+offense+vs+zone PDF link annotation
    • http://tokio-2020.fun/wosomop93f81.pdfIn PDF document text
    • http://lovemecompletely.com/44342536286xia3c.pdfIn PDF document text
    • http://photoforce.ru/dragonology_field_guide_to_dragons_authorkwkmq.pdfIn PDF document text
    • http://handler-autoscout24.com/vizio_e601i-a3_adding_appsnka6k.pdfIn PDF document text
    • http://drnextact.xyz/gegenufupigufajobaus8vm.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://69cf8a46-0d3d-4b71-8fd1-93df925da18e.filesusr.com/ugd/e4064d_c1ec12165cb74afc8af67e7446539c45.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a253a090-22e3-402c-87bd-15be7d07f795/nojuvadudepigupuvajob.pdfIn PDF document text
    • https://s3.amazonaws.com/kubafezin/73655678224.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b8068c6-a463-47b2-ab05-9371886052a8/pipe_fitters_blue_book_app.pdfIn PDF document text
    • https://e1cd7dcf-8988-4be8-9b1a-722367337987.filesusr.com/ugd/6203b9_d93198fecae84767b767f6007ffab608.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f7a6938-178c-49aa-a61d-9132be4d22bd/hamilton_beach_breakfast_sandwich_maker_with_timer.pdfIn PDF document text
    • https://5e3b32e6-a537-4a58-a531-ef303a468713.filesusr.com/ugd/120874_940c198ff3d44aa4a6d3403dc46a3435.pdf?index=trueIn PDF document text
    • https://e0d0d77b-4c00-4265-bc22-f0cc5cf11ada.filesusr.com/ugd/957eb4_fed4a89a5e4d457d84e588603e0152cf.pdf?index=trueIn PDF document text
    • https://c63359c4-faa5-40af-ad11-254ddd3d100c.filesusr.com/ugd/838c33_dcdc5955a93a40b0a691ab79dd96f370.pdf?index=trueIn PDF document text
    • https://387a498e-9551-4239-9507-3183ba214552.filesusr.com/ugd/cd403b_642bb77b9b454e2cad49814f41e1d5a4.pdf?index=trueIn PDF document text
    • https://02664c88-84e5-42fa-aae3-682d3a0d4328.filesusr.com/ugd/39d081_ad0c5b1770c248d3a1627e1604a2f661.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jevelel/anniversary_song_djjohal.pdfIn PDF document text
    • https://d190c387-1498-4382-a59e-98d1a0a9794c.filesusr.com/ugd/a91264_5f92bd3eded448da86022e3adfdf341b.pdf?index=trueIn PDF document text
    • https://e1cd7dcf-8988-4be8-9b1a-722367337987.filesusr.com/ugd/6203b9_11a8360de8e94765af88ad48d6a6fcf2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fifomi/agricultural_systems.pdfIn PDF document text
    • https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_72b586eb20c0407793ba111e2b789413.pdf?index=trueIn PDF document text
    • https://a4067306-84c0-45ce-9c36-3cbb795fcb37.filesusr.com/ugd/d5b970_5603b9a6c1c1400990ce3ce8f48a4cac.pdf?index=trueIn PDF document text
    • https://09235f31-469a-4613-94fc-36d04c1f642a.filesusr.com/ugd/8b6407_887b5f177500435a9f0a4af48763b9f4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rumezo/25208949990.pdfIn PDF document text
    • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_50b1b1e497a84cb581c151353f4accd2.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101CE 4564 bytes
SHA-256: c3bfe1b67989ffa0f683e9f384aa6e7ba2c3c785cc4413f65b2fe236545981aa
font_01_sfnt_off00011182.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11182 11204 bytes
SHA-256: 6ccf9c8f0d1e1b15a92044c2bec85b7aa8a89ea2a7184225f20816970cb7c27b

Open this report in the interactive analyzer, or submit your own file for analysis.