Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f27f2570a8f70d7…

MALICIOUS

PDF

88.9 KB Created: 2021-03-29 01:45:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e5db7c9fe28cb3df1a50f86c0cb210a4 SHA-1: b5e9e4de0e4e26032bfa9a295c620fb839c91e18 SHA-256: 5f27f2570a8f70d764ed432ae9423cd0194894d61d3b0eee593cd57a99d184df
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, many of which point to disposable domains and are likely part of a link farm designed to redirect users. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically phishing or trojan activity. The presence of external URIs and a link farm heuristic suggests the primary goal is to redirect the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=oracle+sql+date+time+format+milliseconds
    • http://itawomen.fun/96964814266tn1ja.pdf
    • http://securityverifiedservices.com/krk_rokit_5_g3_white_noiseyasm0.pdf
    • http://s-tochka.ru/how_to_change_the_time_on_my_versa_lite_fitbittcgwk.pdf
    • http://itravelgr.com/vurizuxemotefatulebesipeghcdn.pdf
    • http://avlto.best/6417501407mk9ln.pdf
    • http://shoop-fk.ru/81760281876fnz4i.pdf
    • http://help-bluebadgecustomer.com/61455134339kb1vk.pdf
    • http://domen3.club/pong_master_mod_apk1pbgt.pdf
    • http://torchland.xyz/foseremodomj0n3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8a5a474a-a671-4857-921d-d1df0ee72544.filesusr.com/ugd/523716_6fd39fca24b845f9a7c4890919a4dbce.pdf?index=true
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_f0e5a59d81da4fb4a37a74d87f5a74e6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c686090a-061e-4407-8f12-3631046cfccf/eyelash_extension_training_course_near_me.pdf
    • https://uploads.strikinglycdn.com/files/9ec0bded-b8a3-4384-847f-9cc5b269dd3b/kuzafebuzowukebal.pdf
    • https://uploads.strikinglycdn.com/files/0d379fbc-23f7-4eec-a43c-e626350e9842/the_merchant_of_venice_online_book_with_line_numbers.pdf
    • https://s3.amazonaws.com/wujixus/toeic_email_answers_mystic_messenger.pdf
    • https://s3.amazonaws.com/lezerawe/96758780272.pdf
    • https://79e8b926-cc52-4cef-90ae-68e3990d752e.filesusr.com/ugd/694d5d_836c473d49044b2bae3034712dff66f9.pdf?index=true
    • https://s3.amazonaws.com/tigewibejageju/95093128037.pdf
    • https://f6b99bba-f064-431f-ab68-6eacb91b2703.filesusr.com/ugd/35e1ce_252d18af7fec479e80c53d9b62b9cdc2.pdf?index=true
    • https://144c9d4d-401b-437b-b89f-6a5816d7da47.filesusr.com/ugd/cd33f5_311f5871628a4b6da0d60b97811f8d3f.pdf?index=true
    • https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_5bdef030899249e9afa167f030e4ff6a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ddae9396-4b74-43ab-8bb0-dd5ab1cf6e0a/what_are_the_types_of_expository.pdf
    • https://c1908cc8-b41e-4b5b-ab1c-53d28a7f2745.filesusr.com/ugd/913720_a643936a09894950ace0ae68636d6491.pdf?index=true
    • https://s3.amazonaws.com/vetamedisoz/english_to_marathi_dictionary_app_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f89d.bin
29c329bf4d57ab76d4f8c224f56b287f8ced8aa1176d755499205a265dbe27a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF89D 5320 bytes
font_01_sfnt_off00010a99.bin
536bb5c225c2af4d50112e31d68f7941f2070d9c153e185d6c478199a7f0c8a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A99 17204 bytes
font_02_sfnt_off00013e82.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E82 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.