Malicious PDF — malware analysis report

Static analysis result for SHA-256 54065f3ee63423c7…

MALICIOUS

PDF

83.0 KB Created: 2021-04-14 05:30:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: ef969320da898fdcf3d4f62c651de266 SHA-1: b0c2f43ba6aa82817d3bbbd192ddf2b074187474 SHA-256: 54065f3ee63423c7b993ae40d26e00dd1df08fb8d4b6d29b564cef3633dd8a77
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier clean score 0.2102

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=int%25281-cos+x%2529cosec%255E%25282%2529xdx+is+equal+to PDF link annotation
    • https://cdn.sqhk.co/tenokesime/9zBihJn/cannondale_xl_frame_size_in_cm.pdfIn PDF document text
    • http://majovevalaji.sportsontheweb.net/download_the_hunger_games_indonesia.pdfIn PDF document text
    • http://nomevufaneboja.mypressonline.com/cazadores_de_sombras_origenes_principe_mecanico.pdfIn PDF document text
    • https://cdn.sqhk.co/vawapisoxe/gkjfgha/70349776233.pdfIn PDF document text
    • https://cdn.sqhk.co/vavewiren/ZiivjeM/bingo_wings_exercises_for_over_50.pdfIn PDF document text
    • https://cdn.sqhk.co/xarozowuzosa/Zyhdjir/marvel_realm_of_champions_ios_download.pdfIn PDF document text
    • https://cdn.sqhk.co/tilafukefuwe/irgi6gd/74416766880.pdfIn PDF document text
    • http://fegivate.medianewsonline.com/26882479880.pdfIn PDF document text
    • http://dusejetiwogodad.getenjoyment.net/ramadakugefusolidugux.pdfIn PDF document text
    • http://calipshatngaccs1.xyz/crime_and_puzzlement2nlif.pdfIn PDF document text
    • http://bit7.top/9910206443vpadg.pdfIn PDF document text
    • https://cdn.sqhk.co/zikufivol/Nia3Mjf/51788684771.pdfIn PDF document text
    • http://sandiego-podcasts.com/688361148294aaxc.pdfIn PDF document text
    • http://nibelv.xyz/8930578154716v3h.pdfIn PDF document text
    • http://fezufizibum.mypressonline.com/rixomipuroxarudufen.pdfIn PDF document text
    • https://cdn.sqhk.co/gizoxemovefi/eUgil2m/89625275916.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://javasuk.epizy.com/racing_car_game_please.pdfIn PDF document text
    • http://riledabetime.myartsonline.com/bsc_part_1_math_book_download.pdfIn PDF document text
    • http://wosaxadef.rf.gd/65755924904.pdfIn PDF document text
    • http://luregaw.onlinewebshop.net/24694665137.pdfIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d36b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD36B 9016 bytes
SHA-256: cb120d34078a7dba0257c306ca4bf637d8b2b824c72283cdef92eee65327eb89
font_01_sfnt_off0000eb81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB81 3040 bytes
SHA-256: b56e44a968f246fdada724ceb2fc79b5886f2a8c3ca64efa6aa23516d49574b9
font_02_sfnt_off0000f66e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF66E 5388 bytes
SHA-256: f2857aa11f05c61b3bc21044ed9b9a01d4a6b263a4296d3ac251cc0ac69d9597
font_03_sfnt_off00010902.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10902 12728 bytes
SHA-256: 79f8bb9a35fe5e4d6885a047d3f1585c9348cdf20a430bab1d66cd3a37235438
font_04_sfnt_off0001320a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1320A 16036 bytes
SHA-256: 52db30b66cfb76898988bc7c6ed152514c301740808ab95bec9c68e49df23550

Open this report in the interactive analyzer, or submit your own file for analysis.