Malicious PDF — malware analysis report

Static analysis result for SHA-256 584ad4f7ed64f620…

MALICIOUS

PDF

81.6 KB Created: 2021-09-20 08:21:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 62da73ae9edcc133f20a87383baaaf5e SHA-1: d3679ee96275661558e468b85e5073cf205fea77 SHA-256: 584ad4f7ed64f6205cce534e809bc80eacafdeea4328bfc5f8231f1512173522
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous external URIs and is flagged by ML and ClamAV as malicious, indicating a phishing or malware distribution attempt. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests a deliberate attempt to create a large number of links on disposable hosting, likely to obscure the true malicious destination or to spread malicious content across many domains. No scripts were extracted, but the presence of many external links points to the document's primary function of redirecting users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9972

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://archism.ru/uplcv?utm_term=pendoo+firmware+update
    • http://cjmfgxfollow.morefriendship.com/upload/files/lelidurasureruxuzela.pdf
    • http://oresteruggiero.com/userfiles/files/rimovokigifeju.pdf
    • https://detmers-kontejner.hr/files/vazonalifuwimibiposutadu.pdf
    • http://szyoujin.com/UploadFile/file/20210916035009810.pdf
    • http://www.consorcio.edu.pe/wp-content/plugins/formcraft/file-upload/server/content/files/161307dbb38609---54516655601.pdf
    • http://logicamail.it/draft/media/14736396945.pdf
    • https://detmers-kontejner.hr/files/55966116393.pdf
    • https://ntpuvoice.com/ckfinder/userfiles/files/62944276912.pdf
    • http://vinag7furniture.com/app/webroot/files/editor_upload/files/44144013884.pdf
    • http://ferrogep99.hu/static/media/file/motumexarira.pdf
    • https://villamishkan.com/310renonew/front/images/files/foror.pdf
    • https://n-vv.dk/userfiles/file/jopijuzijutenoj.pdf
    • http://uticachemical.com/files/upload/files/govixororunodoba.pdf
    • https://cosonnguyenthanh.vn/webroot/userfiles/files/ximerusa.pdf
    • http://www.loockuniformes.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/16137e5e0243b0---puvewoduk.pdf
    • https://www.suep.gr/ckfinder/userfiles/files/3030789140.pdf
    • http://topmebli.com/content/xuploadimages/file/debiwoz.pdf
    • https://vadihosting.com/calisma2/files/uploads/36350425983.pdf
    • https://na-nule.ru/wp-content/plugins/super-forms/uploads/php/files/mvrsekj4r3hr5op5222uan2nl6/551915066.pdf
    • http://nuraski.pl/wsg/userfiles/28023304891.pdf
    • http://stauarchitetti.eu/userfiles/files/sozunagugugetarurat.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d968.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD968 16792 bytes
font_01_sfnt_off0000f17f.bin
2455271be6f6a6e870e9b9f8f2be62048435efc0abc0395f3e2ecbd2ac284c90		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF17F 10632 bytes
font_02_sfnt_off000109d9.bin
ea040e4b36a1df81d94280b4b46afe8832909e84a233d809790622166277a85e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109D9 18184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.