Malicious PDF — malware analysis report

Static analysis result for SHA-256 5db3958fb54b290d…

MALICIOUS

PDF

124.7 KB Created: 2021-05-29 05:49:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 39b5463760059c495c57a3af3edf8aca SHA-1: 36eeff46ed6f825a5be4f567ade15b12ced53aaf SHA-256: 5db3958fb54b290d822681cdf9e068ccd8ae747f9f03bd5274074b0a37910480
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified as a link farm, with a primary lure of 'collocations exercises with answers pdf'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or SEO manipulation. While no scripts were explicitly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9622

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=collocations+exercises+with+answers+pdf PDF link annotation
    • https://fowanexi.weebly.com/uploads/1/3/4/6/134648222/9355110.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382621/normal_603971c29fa6a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443595/normal_606358d9697fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451377/normal_604bbd8699096.pdfIn PDF document text
    • https://degufulu.weebly.com/uploads/1/3/1/3/131379990/4065176.pdfIn PDF document text
    • https://pajilolupifi.weebly.com/uploads/1/3/2/3/132302794/6058248.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4388420/normal_5ff1954dc8181.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387581/normal_6067a62f332e0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416327/normal_5fe7adb22f691.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375541/normal_605a22ac8c493.pdfIn PDF document text
    • https://newavutija.weebly.com/uploads/1/3/1/8/131871734/8513224.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404123/normal_606cb52c0b28c.pdfIn PDF document text
    • https://memarexegota.weebly.com/uploads/1/3/4/3/134366516/merosunimaruxopo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.orgThisIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://uploads.strikinglycdn.com/files/124c236a-528b-4da3-9207-630139a63c8c/information_technology_degree_salary_reddit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0cc079d2-8674-467b-bac5-27bb6cee81ce/the_crown_season_2_episode_6.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e5ebc54-cdb9-4a89-90fb-9233d04c0603/how_to_install_forward_facing_graco_extend_to_fit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19d80e26-7fcd-449a-b30d-3e7d5def8ce2/80808482749.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc0e68d7-fe05-45d7-8ede-905cf56c5a1b/30853713648.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c66744d1-907c-4797-8c14-02bed66b7349/nedemapeget.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc40242d-7734-4bb3-b081-353febc96e22/46504134784.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d51bd69-5587-4b07-a8cf-10c0cd54aa21/gapafinud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55800a56-c988-47c5-8f38-c9878e13f2dc/remington_model_24_serial_number_location.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/062da5e0-1aad-4fab-8b20-6d32b6096c31/dexenixuwa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54628101-9829-4eeb-8f0f-1042a0424b07/27000021584.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b069af6-62c3-43e5-8399-0960fbfbd180/92812662762.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://scripts.sil.org/In PDF document text
    • http://scripts.sil.org/OFLAbyssinicaIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011c9b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C9B 6704 bytes
SHA-256: dfc492842d791b4d856b45a147dd07c884e0773c4cd28432e552204f9553ec9a
font_01_sfnt_off00012d24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D24 6432 bytes
SHA-256: 52c8843e6420c801ef7df95e0e5d683b94627e8dec877901c2a756368ba14a22
font_02_sfnt_off000142c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x142C6 5308 bytes
SHA-256: b6364d9c312f89bd803cbca2fa5be696bf87438e9ac7ec2a64d7d335fd3dced1
font_03_sfnt_off000154e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154E2 20952 bytes
SHA-256: d80b5fc1c935f16a9745b3d8381ed33f933a7e0041b7a8b58df3edec2ac11063
font_04_sfnt_off000174fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x174FC 5728 bytes
SHA-256: 0e921caa5acfa5a55094ac99d3f6fb2e5d63191657a0ff996cc139e3cac0ebfe
font_05_sfnt_off0001834c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1834C 16932 bytes
SHA-256: 5eba40320bef4f65cb6443941cbf0a659a6f4e740f3c47b9d7a0eac3236c5dbc
font_06_sfnt_off0001b928.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B928 17200 bytes
SHA-256: a7406bb8c16b8c204e7e7c7d2e0f02f4871c358fe61d458458a16d178544d9b4
font_07_sfnt_off0001d292.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D292 6296 bytes
SHA-256: b015f0e0e40d69bed0c393c519362160a4d76d87b180f252eca81d9a14982256

Open this report in the interactive analyzer, or submit your own file for analysis.