Malicious PDF — malware analysis report

Static analysis result for SHA-256 53671d4757c9e864…

MALICIOUS

PDF

96.4 KB Created: 2021-04-01 06:52:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 010d409bb4b1b9ab6bd8b4bfb494b910 SHA-1: 1264e0b12689ae7686e6b70b6601a6388d80f75f SHA-256: 53671d4757c9e8643da9e6f096f7226bc32263c63d7c2d8fc686f8f7c07f1a9f
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm designed to redirect users. The presence of 'Pdf.Phishing.Trojan' in the ClamAV detection and the ML classifier's high confidence score further support a malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's used to lure users to potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=%25D8%25AF%25D8%25A7%25D9%2586%25D9%2584%25D9%2588%25D8%25AF+%25D9%2586%25D8%25B1%25D9%2585+%25D8%25A7%25D9%2581%25D8%25B2%25D8%25A7%25D8%25B1+%25D9%2585%25D8%25AF%25DB%258C%25D8%25A7+%25D8%25A7%25D8%25B3%25D8%25AA%25D8%25A7%25D8%25B1+990+uneva PDF link annotation
    • http://shopyou.online/what_describes_dimensions_of_conflict-handling_intentionsexnxc.pdfIn PDF document text
    • http://ultra0.space/299962366983gtde.pdfIn PDF document text
    • https://bijejosuti.weebly.com/uploads/1/3/1/6/131637047/kikojes-bemebu-libaf.pdfIn PDF document text
    • https://lasapiboxemifol.weebly.com/uploads/1/3/4/8/134865682/d76d9b3c.pdfIn PDF document text
    • http://teplotronic.ru/email_template_to_inquiry_about_a_jobcvlc2.pdfIn PDF document text
    • https://gebaxugore.weebly.com/uploads/1/3/4/5/134594027/9844397.pdfIn PDF document text
    • https://bifekanivixu.weebly.com/uploads/1/3/1/4/131408854/gunedosebij.pdfIn PDF document text
    • https://sapuzexa.weebly.com/uploads/1/3/5/3/135348006/goxutagas.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f4dd034e-00c7-465c-b850-fb2d75accad5.filesusr.com/ugd/769f78_34a6fa69ff724b3595a7bcddcd5c42f8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3669703f-76cb-4c93-9249-09944bccd8d1/punuwomafusuxabogakipuxof.pdfIn PDF document text
    • https://507d1b22-ea03-4061-a262-f79425337ca2.filesusr.com/ugd/a374b9_5ff03947bc5b4385b711205c550e47e2.pdf?index=trueIn PDF document text
    • https://1b6fe947-be7e-4494-9a94-f566f178d3d1.filesusr.com/ugd/89064d_67561ae9d8db4a7181c6d47e55a20b80.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/44217f31-901f-461f-94d9-a61d3af525a8/rovurikuleper.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0fb1395c-9bd8-4052-b4a5-ef48642d6de2/old_testament_bible_stories_in_order.pdfIn PDF document text
    • https://f1801c53-b3f5-4b94-a9b3-4bb8eb376a66.filesusr.com/ugd/af633f_c296989e32054651b5be60922356c139.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c9ec301-bafa-40da-91ad-7d33c9bf1bcf/windows_keyboard_shortcuts_turn_off.pdfIn PDF document text
    • https://89e5ed4a-33eb-42a6-b5f1-9fc07ea1e15b.filesusr.com/ugd/ff68bb_10ff0d3c2757464f99ca01d8f74c75c0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8aefddd1-0496-4f75-826a-0aded370aebe/39185816919.pdfIn PDF document text
    • https://76bf42c0-7447-45ed-8dd3-33f9786ae3ae.filesusr.com/ugd/ba2c19_76542695e4414062a44fb4e94aa89097.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00013e37.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13E37 28176 bytes
SHA-256: 33a6ce354bed7ba9035ac6ca61da3b2dcb915b8e2121d249df3d5e8fb526cc82
font_00_sfnt_off0000e4c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4C1 4636 bytes
SHA-256: 2b17789a1ae6f50a347ce4d5a653833950df50aea1a1abe0eb8c9ecfb769c506
font_01_sfnt_off0000f498.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF498 3076 bytes
SHA-256: 751b4864c287931aa1c5a5ce9dd4bb013e7bae2f826523689018b434607221fc
font_02_sfnt_off00010137.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10137 10008 bytes
SHA-256: 6b75c1cacba246f71c8bc422ce2588f3d9edd31b41d92f961f2291293ae5bef6
font_03_sfnt_off000123aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123AA 17752 bytes
SHA-256: d9fa451398ab20be2edcdc29911d4ed6bc5d33235e43d7b807d4acbd730e6bb1

Open this report in the interactive analyzer, or submit your own file for analysis.