Malicious PDF — malware analysis report

Static analysis result for SHA-256 53fd44f0e61e45d5…

MALICIOUS

PDF

96.7 KB Created: 2021-04-25 17:25:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 389364686b747d6713ad89629018124f SHA-1: 413c1d2c3bbb4d1314bf3120692e1f203612613a SHA-256: 53fd44f0e61e45d5dce51a71a9d155b5775ac99e5df07589952b530584e3e2fc
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a lure referencing a movie title, likely to trick users into downloading malicious content. It includes a large number of external links, many hosted on disposable domains, suggesting a link farm designed to distribute malware. The ClamAV detection and ML classifier strongly indicate malicious intent, with the PDF likely serving as a dropper for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=perdona+si+te+llamo+amor+2014+pelicula+completa+en+espa%25C3%25B1ol PDF link annotation
    • http://rumepado.mypressonline.com/36501945080.pdfIn PDF document text
    • http://pasendapp.online/68633642471vilt.pdfIn PDF document text
    • http://xoziduso.mypressonline.com/damodarastakam_in_bengali.pdfIn PDF document text
    • http://halfraire.xyz/medidas_de_polines_de_maderagsp37.pdfIn PDF document text
    • http://dfwshootersupply.com/nuwabome2pxkk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bipepezuwed/migavunimijuketisago.pdfIn PDF document text
    • https://4e33067b-0f13-4bed-bb9c-ea95f768fd7c.filesusr.com/ugd/23924c_decb487438014aa5abbe34ce070b2054.pdf?index=trueIn PDF document text
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_90a44867302f45c6893893c20fc48fa3.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/28bf9d1f-2d97-43c5-a8e4-43891230aadd/33634122254.pdfIn PDF document text
    • http://mozaninukokefef.onlinewebshop.net/74061195767.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cd1dd76-d51c-4e6b-8d7a-204ff7485a31/52674390932.pdfIn PDF document text
    • https://5e20aa6b-77ef-4f11-9344-5454fb7c649c.filesusr.com/ugd/fb3aa9_d31213e2fe104dde81e53071888ee414.pdf?index=trueIn PDF document text
    • https://9f349447-249b-4747-956a-316fe86e371b.filesusr.com/ugd/d2b720_8625f433aabf412cb3134556c21c9229.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lepefi/68012794839.pdfIn PDF document text
    • https://fae5df41-d68b-4d62-9961-cd33801cec7e.filesusr.com/ugd/f52c73_70ef1c75011748d2ad96c48a797572f1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/safenalavojuwu/5774798547.pdfIn PDF document text
    • https://3c31dc6e-14a3-4e60-a373-897e90814001.filesusr.com/ugd/9e17d8_d534df2afdfb4a16b47f278808d9637e.pdf?index=trueIn PDF document text
    • https://e5eb5b25-b33c-43e3-82d5-57ab1bf863d8.filesusr.com/ugd/b0c717_2f6410ae70ab42f3bde3df2a502cfd9f.pdf?index=trueIn PDF document text
    • https://7e70056c-c2aa-4e53-98c5-50750123c107.filesusr.com/ugd/f8ae5d_af4507230e2b413585fc88c8ace135ee.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/100b3aa0-2587-4215-bc71-b90cadaee201/fesudegemitijoxiroduripa.pdfIn PDF document text
    • https://6e229dea-1f83-4be8-8cd3-388eabd4f5e3.filesusr.com/ugd/1cfe37_559e3d4c2466483a837d7f90979a3e0c.pdf?index=trueIn PDF document text
    • https://57fc24c6-ba7c-430a-bdae-05304608b610.filesusr.com/ugd/bc9c68_2130289113ca4cb2ace37a36275fe413.pdf?index=trueIn PDF document text
    • http://muvipej.atwebpages.com/amplitude_modulation_chapter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b93a57f-9e83-4b1b-ae31-6736e0010fa9/lazunizi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00014743.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14743 24452 bytes
SHA-256: 6f4d9e2a0b5e3de7d63588881931245ae5171377c66cc8a69e4f8e8630fea7a8
font_00_sfnt_off00010776.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10776 5844 bytes
SHA-256: ab25505dc0a2a188563b2c2e283a8a839f44f91a74916d338f375a78b55af9ad
font_01_sfnt_off00011b12.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B12 14504 bytes
SHA-256: 9262ff9a88d1e2a4c74acf25cbeaafb5c78047cdb9d4f2b602f6607e6ef655e6

Open this report in the interactive analyzer, or submit your own file for analysis.