Malicious PDF — malware analysis report

Static analysis result for SHA-256 53105f3a1afa1a00…

MALICIOUS

PDF

83.9 KB Created: 2021-03-30 11:13:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 1ae9616787e56092af1873cffc686f8e SHA-1: c9448e9e21de6d19b7f102f3515312996eb5fbfe SHA-256: 53105f3a1afa1a0030882968659df8ea9b6e5bbb470bfc91edae8c7e62da57de
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a primary URL pointing to a suspicious domain that appears to be part of an SEO link farm designed to distribute malicious content. ClamAV and ML classifiers strongly indicate this is a phishing or trojan PDF. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=advanced+british+english+grammar+pdf PDF link annotation
    • http://gavefunene.22web.org/biblia_del_peregrino_nuevo_testamento.pdfIn PDF document text
    • http://diwokaxojizo.iblogger.org/braun_series_9_9290_manual.pdfIn PDF document text
    • https://kusebavizekofuk.weebly.com/uploads/1/3/4/0/134098677/moputigem_sixowed_jesuz_fumavunilibive.pdfIn PDF document text
    • https://vikurevago.weebly.com/uploads/1/3/1/6/131606257/07852d7.pdfIn PDF document text
    • https://berapozi.weebly.com/uploads/1/3/0/7/130776213/kenuzidedanifosudaxi.pdfIn PDF document text
    • http://zitokik.iblogger.org/naxinupaferirerewikobi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mexesazaxasa/remington_700_sps_stock_weight.pdfIn PDF document text
    • https://1b15a19f-c8c2-4d9d-8c2f-e97aa7ecfe2c.filesusr.com/ugd/eb6c48_566f3c2caa9a41b3bea5f9cc0ec50208.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juwofuxufijup/gmdate_php_format.pdfIn PDF document text
    • http://tiginusoxer.rf.gd/87916384566.pdfIn PDF document text
    • https://s3.amazonaws.com/sojebelevenex/49336289604.pdfIn PDF document text
    • http://vufuditot.rf.gd/kipugojazaz.pdfIn PDF document text
    • http://zasegusof.epizy.com/76262624684.pdfIn PDF document text
    • https://11ca5eb4-0abe-4d5d-8073-3f36f6088e80.filesusr.com/ugd/8b62d8_0100e5c3bc6641ab8e106c35661a5c72.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wuxupewu/python_list_comprehension_if_or.pdfIn PDF document text
    • https://s3.amazonaws.com/jobavo/verbs_and_adverbs_worksheets_grade_5.pdfIn PDF document text
    • https://e3c65705-3664-417e-97b1-2ac29bfab8bd.filesusr.com/ugd/6a5da5_f694466bd5f444e49fbc78c58766fe7a.pdf?index=trueIn PDF document text
    • http://sebipukavore.epizy.com/3092197679.pdfIn PDF document text
    • https://s3.amazonaws.com/zagapaxa/what_does_loan_term_360_mean.pdfIn PDF document text
    • http://ninukak.epizy.com/gawovuzemofo.pdfIn PDF document text
    • https://f421159b-d329-41e8-bc42-072bc93e4c50.filesusr.com/ugd/65d6f7_e99b43688fab41faa82ae2a606eb87d7.pdf?index=trueIn PDF document text
    • https://9305c775-266c-4126-9ef9-90a5cffee957.filesusr.com/ugd/c3f88d_2f7733147a324f6eb19bd7ac545414d9.pdf?index=trueIn PDF document text
    • http://pulupalu.epizy.com/54078268531.pdfIn PDF document text
    • https://s3.amazonaws.com/wupagivoz/zakulawulifuzezafirinos.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010539.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10539 5756 bytes
SHA-256: 73307359065a1f5aa8d28edbae4a3559236617ca3f36998c7191a5cf2efad91a
font_01_sfnt_off000118a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118A8 12352 bytes
SHA-256: e58e820b197622610e76ede2362504719ded2592505cf845fcbf1cff4f8cf40e

Open this report in the interactive analyzer, or submit your own file for analysis.