Malicious PDF — malware analysis report

Static analysis result for SHA-256 56a6d4f26fb47382…

MALICIOUS

PDF

77.1 KB Created: 2021-05-15 19:23:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 1659d1d1347086ad885483f0cd32b511 SHA-1: aa94a3fb11348a5cf623834635d2ec4cc96d66fb SHA-256: 56a6d4f26fb473829c117a9b523f164237c9d45daa295ffbc9dc22079b388c30
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users. The document body, though heavily obfuscated, contains text related to installing TV remote controls, likely a lure to encourage clicks on these malicious links. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=how+to+install+tv+remote+control PDF link annotation
    • http://qqkaxes.xyz/94408730880rahlr.pdfIn PDF document text
    • https://lumevukivejus.weebly.com/uploads/1/3/0/8/130874583/4821099.pdfIn PDF document text
    • http://nubolutlion.xyz/cute_cat_hd_wallpaper_imagesc1ben.pdfIn PDF document text
    • https://lugigotaxur.weebly.com/uploads/1/3/0/9/130969655/6884842.pdfIn PDF document text
    • https://wuremuzagatixob.weebly.com/uploads/1/3/4/6/134612401/66cefe55ae5.pdfIn PDF document text
    • http://flowerport.market/bathroom_sink_stopper_assembly_diagrami2rz5.pdfIn PDF document text
    • http://prod-fruit.space/44704321380fjond.pdfIn PDF document text
    • https://bawoxuvebi.weebly.com/uploads/1/3/4/8/134886771/mipidoxizeboxefo.pdfIn PDF document text
    • https://giliruba.weebly.com/uploads/1/3/1/4/131483170/1192461.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://suvowafavij.epizy.com/baixar_livro_genetica.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70bed7e2-4b46-405a-b31f-a0a36483019e/the_science_of_logic.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23eb0e95-707b-4d96-84b5-e308958591d2/best_snark_ukulele_tuner.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6b162ec-e2c1-44a9-b04c-cc63a4c84151/78945681768.pdfIn PDF document text
    • https://b56e6f12-3f4b-4b75-bc29-9585eb3fba71.filesusr.com/ugd/73f0dd_3445b4896a4f4b01b7c6ab5e2e558f90.pdf?index=trueIn PDF document text
    • https://76bf42c0-7447-45ed-8dd3-33f9786ae3ae.filesusr.com/ugd/ba2c19_c26184e9a5d14753af1606a149c79e14.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2261955-630e-48d5-b450-8e8cc0b20943/can_i_play_simcity_on_mac.pdfIn PDF document text
    • https://e0a971b2-7104-4718-9e5f-4f17d768618f.filesusr.com/ugd/6d43b6_aa36ec40420349918112e43b537480bb.pdf?index=trueIn PDF document text
    • http://daguvagobilat.rf.gd/architectural_drawing_course_mo_zell.pdfIn PDF document text
    • https://40c507a3-37b7-491f-afd3-f28ba3af1fb2.filesusr.com/ugd/7f5264_4ffe705545f943c8adac2f259cf20e00.pdf?index=trueIn PDF document text
    • https://327bbe42-9aa5-4ca0-80e5-6c9857058a26.filesusr.com/ugd/2b870b_35d524608d5442c5949957dc13b1297e.pdf?index=trueIn PDF document text
    • https://109d6476-c6f4-4eee-b84c-907698fb4207.filesusr.com/ugd/0d7ebf_5590a949df92456eb42f6cbc6b1bf05c.pdf?index=trueIn PDF document text
    • https://abc5f1b3-ad37-4660-b048-d9bff2240d70.filesusr.com/ugd/a1fb68_426ce2a67bb749e992efaac2c42e0136.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00010d7c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x10D7C 17260 bytes
SHA-256: 8746d329cb5ed91125047a767a3e7d4c5edcfc333821e4f41132b828bfabcc92
font_00_sfnt_off0000d8aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8AA 5060 bytes
SHA-256: cd841abd26c803bbbcb954d65ef6039e5bb83016dda86a47e044b2a47a51beca
font_01_sfnt_off0000e9dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9DC 10328 bytes
SHA-256: 05e4aa5029a99b4347b0f56bce7e426b29920d91bc952e61f142e9aa475708cd

Open this report in the interactive analyzer, or submit your own file for analysis.