Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f8791deaa3f1155…

MALICIOUS

PDF

82.6 KB Created: 2021-03-15 21:09:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1dd5bcf484254750fb330bc9baa6a59b SHA-1: bca6f1183fbd1c01f1798f183729d83574c2ca9a SHA-256: 5f8791deaa3f1155e7daa3e83238ed8a1d10767c664ee2d88d6ef37d63c55ec7
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file identified as malicious by ClamAV and an ML classifier. It contains a large number of external links, many hosted on disposable domains, indicating a link farm designed to redirect users to potentially malicious content. The PDF_SEO_LINK_FARM heuristic specifically highlights this behavior, suggesting a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=isi+envision+guidance+manual
    • https://xekariwunaju.weebly.com/uploads/1/3/1/0/131070431/muler.pdf
    • https://ponuxarazuzega.weebly.com/uploads/1/3/5/3/135328107/kidulomika.pdf
    • http://zumepaposakuf.scienceontheweb.net/delonghi_de320_dehumidifier_manual.pdf
    • http://vowufijetapiko.sportsontheweb.net/can_you_still_get_applecare_after_90_days.pdf
    • http://fadulifakibul.medianewsonline.com/42997683227.pdf
    • http://fiziwafofekaku.mygamesonline.org/sotesapobukewusumufiwamum.pdf
    • http://butalinonoruma.scienceontheweb.net/vebudevirobunezuzuwosuwas.pdf
    • http://lazisirogabidir.mypressonline.com/lituzor.pdf
    • http://vawadofofasip.getenjoyment.net/dell_b2375dnf_manual.pdf
    • https://fisujurij.weebly.com/uploads/1/3/1/4/131437504/nafafegas_jeputa_tipiki_keziruvotemulal.pdf
    • http://gekodejevotug.medianewsonline.com/75981307778.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f18b8dc1-3ce9-44bd-8712-01435d039869.filesusr.com/ugd/b97cba_828fbf80630646ebac21e2a95f8aa5c8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/110015cf-164d-4cd5-9dc9-9452607e69ba/how_to_change_resmed_cpap_filter.pdf
    • https://0efdb04f-128a-4c0d-ace4-8b312723ebcc.filesusr.com/ugd/5508f4_ac6e54434515403e9b1e111884ca5945.pdf?index=true
    • https://35057dd6-1d18-4acd-96c9-af3b7fddc7cd.filesusr.com/ugd/978dd5_33b992ff815c47f9bcfc9155e46d4598.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2fc1465f-ee5f-4b7c-b926-e847686f4da5/blooms_taxonomy_domains_ppt.pdf
    • https://uploads.strikinglycdn.com/files/cfee1393-1d1f-41ee-b02a-4d60023ef051/78681631925.pdf
    • http://zagofij.onlinewebshop.net/difference_between_apoptosis_and_necrosis.pdf
    • http://ditanumugagoma.myartsonline.com/puvemajiw.pdf
    • https://46fb9a51-9e16-4ad8-811e-2f7ed01702f7.filesusr.com/ugd/53363c_1a8ad28f35e449c4b6e68cbb72b2a985.pdf?index=true
    • https://uploads.strikinglycdn.com/files/68421df8-af62-476b-ae70-bbcdb5d2c457/sony_dav_tz140_price_in_pakistan.pdf
    • https://19e6fc83-c281-4d06-93fd-e8b16a02b90a.filesusr.com/ugd/ce5d00_a8d00036fc3349c89201ae3b187a9435.pdf?index=true
    • http://kifesafijupesob.onlinewebshop.net/joxekakirakipojupibaje.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107bc.bin
29006cf395f9658d8bc8c69d892f0c8842f2b1109deb8c1a7a175acfdfa56104		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107BC 5160 bytes
font_01_sfnt_off00011946.bin
72c8d4024971bb53a581f1e33cc8f2de5b16d04d903feb3bbf917a212f2cd151		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11946 10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.