Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e07ac140f6c0cc7…

MALICIOUS

PDF

72.4 KB Created: 2021-04-04 19:06:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: d80ce54ae16a1697c21f9673de86b6c7 SHA-1: 908eddbf8339ede69e803bbd4c6e8fa80d915990 SHA-256: 5e07ac140f6c0cc7d57fa46e348e70821adf22b26acceb5b1b0b31f96911e23b
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to disposable hosting, indicating a link farm designed to distribute malicious content or phish users. The presence of a URL like 'https://gimoguvi.ru/123?utm_term=dr+morepen+bp+monitor+user+manual' suggests a lure to disguise the malicious intent. ClamAV and ML classifiers confirm the malicious nature of the PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/123?utm_term=dr+morepen+bp+monitor+user+manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4460983/normal_6066a38b6c91d.pdfIn PDF document text
    • https://cdn.sqhk.co/nonuripot/gdjflSz/redbubble_free_shipping_code_august_2020.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409614/normal_6052c9faf1b4e.pdfIn PDF document text
    • https://cdn.sqhk.co/jategumeb/bphhfig/sabagovoxodexo.pdfIn PDF document text
    • https://cdn.sqhk.co/rejiwosujupa/cfgjija/tubiruvateduwivaxiwewako.pdfIn PDF document text
    • https://cdn.sqhk.co/xibetevoxaj/cyigibk/library_application_support_paradox_interactive_launcher-_v2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392191/normal_5ffb3d7cbe685.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371791/normal_5fcbe9be7d33e.pdfIn PDF document text
    • https://cdn.sqhk.co/kekumumaxow/chjFYjc/langrisser_1_and_2_ps4_vs_switch.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/445af529-0643-45e9-bd8b-3a89a69d2700/how_to_replace_instant_pot_sealing_ring.pdfIn PDF document text
    • https://67536400-2f23-40e2-9d3a-36ae3f4dfb8c.filesusr.com/ugd/5312ea_8c6b4040bf334834b529a7b9e2dec2ae.pdf?index=trueIn PDF document text
    • http://degavitorepapi.rf.gd/can_dryer_sheets_kill_bed_bugs.pdfIn PDF document text
    • http://merojupamen.epizy.com/rodunumozanivaluv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f960719-e885-46e7-8cc7-5200c971de63/noketinokebabikatepegenis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44b196c5-52ba-4720-8a5c-ac95cdc79b90/the_best_daws_for_beginners.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5de184c0-b9d3-4dfe-96d1-8ac4fde2f495/how_many_calories_does_50_jumping_jacks_burn_off.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2110d07d-d62a-4ac2-915a-6270d23dba6f/the_structure_of_hebrews_a_text-linguistic_analysis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60abde80-51f2-47f9-971b-d57222ef6956/ludisilufotesizaw.pdfIn PDF document text
    • https://a2ae8793-a99f-480d-a3bc-849ef63d34f7.filesusr.com/ugd/cc207a_62be5025b2974ceb9b551825277e87c0.pdf?index=trueIn PDF document text
    • https://790985df-dfec-4a08-b509-00f37668cf87.filesusr.com/ugd/a421e3_b795bf64cedf4f90b721ed742b469173.pdf?index=trueIn PDF document text
    • http://mesesoriran.epizy.com/3830401405.pdfIn PDF document text
    • https://e40da922-b0e4-44be-9878-2d4898ccab21.filesusr.com/ugd/3a38e0_56b34080c12a4354a8b91e50ceda3568.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d090.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD090 4988 bytes
SHA-256: 1f7fd28610301077efbc1b65b57a6fff73a4923ec8f4723a9e3b9c06cee7255b
font_01_sfnt_off0000e158.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE158 10572 bytes
SHA-256: d621896ddd77d96f077a0cb1beb4a65a1fd5c44417bec8c330413e145741c2e6
font_02_sfnt_off00010581.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10581 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.