Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ed751e7f560ae22…

MALICIOUS

PDF

142.1 KB Created: 2021-03-23 00:15:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 6abcb8fd31b51f6def722dcfbe5e0bee SHA-1: a82e51bbee6029954e70341e3743101ca5bc7129 SHA-256: 5ed751e7f560ae225954425b7d9a9f7e4af4d5e9c3f360db889d6155b68bf2c0
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a link farm, with numerous external URLs embedded within its structure. The primary URL, 'https://resalured.ru/strik?utm_term=who+are+the+12+gods+of+olympus', suggests a potential phishing or scam attempt by redirecting users to a suspicious domain. The presence of multiple links on disposable hosting further indicates a malicious intent to distribute or obscure malicious content. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9972

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=who+are+the+12+gods+of+olympus PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4387566/normal_5fd93f693ac1b.pdfIn PDF document text
    • https://cdn.sqhk.co/bupedamarib/eZZjggc/70117093180.pdfIn PDF document text
    • https://cdn.sqhk.co/rureroso/mrDifha/57_ways_to_end_it_all_lyrics.pdfIn PDF document text
    • https://sogatetemurus.weebly.com/uploads/1/3/4/3/134379625/gudikanejo-kozinulasebuk-xadipabipana-zipujamumoxip.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489975/normal_5fcbc7e7bf437.pdfIn PDF document text
    • https://nimimemuxigu.weebly.com/uploads/1/3/4/4/134488465/zuturewaligegume.pdfIn PDF document text
    • https://nixujukasal.weebly.com/uploads/1/3/1/6/131636737/lijemotufidodow.pdfIn PDF document text
    • https://duwiwobejul.weebly.com/uploads/1/3/2/7/132740292/sibineliniz.pdfIn PDF document text
    • https://goxapixexaze.weebly.com/uploads/1/3/1/6/131607486/03fc397ac05.pdfIn PDF document text
    • https://cdn.sqhk.co/bodavadu/YFhdEgf/ducati_scrambler_cafe_racer_off_road.pdfIn PDF document text
    • https://cdn.sqhk.co/kominepoli/ZVhbbgi/zombieland_3_release_date.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448129/normal_605524de74c41.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464315/normal_601e74e2b1fe4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/870ac9bf-6dae-473b-a93f-3d7c8fd75d15/49006832657.pdfIn PDF document text
    • http://leteketo.rf.gd/vokut.pdfIn PDF document text
    • http://fukatotapi.epizy.com/buseluvobut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc309af7-ccc4-441a-b831-2e951c53d6e6/how_to_have_a_new_kid_by_friday_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9596bd01-78b7-4aa7-9600-a684abd2a03a/quadratic_equations_vertex_form_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90eae325-6cb6-40c4-8161-5b6fa26bf68b/how_to_whitewash_pine_shiplap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7998de88-642c-449c-a549-38f1c72151b7/adobe_premiere_tutorial_basics.pdfIn PDF document text
    • http://vuxibir.rf.gd/14430525439.pdfIn PDF document text
    • http://falogivaxaf.epizy.com/craftsman_speed_start_weedwacker_27cc_gas_oil_ratio.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d89d531b-4bfe-4034-995d-10d79321a585/64645137507.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a2286bc-6e32-4834-b759-369df5c5382a/bryant_plus_90_filter_change.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a347f9c-2289-4709-a9bb-891744f365d5/mivibesunibop.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001ed21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1ED21 5752 bytes
SHA-256: 640cacc30e07a4419fc9867fdf11ca9ca6c4e46e0166e2e84b8a54ab5fbfa538
font_01_sfnt_off000200b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x200B6 11648 bytes
SHA-256: 4f958b307cf3cb8ac4eabad54b2f81bdc8f8f474e2d228b35913507735768f6c

Open this report in the interactive analyzer, or submit your own file for analysis.