Malicious PDF — malware analysis report

Static analysis result for SHA-256 6387575633fb3662…

MALICIOUS

PDF

79.8 KB Created: 2021-03-17 19:09:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9b9d6988281702552264e8441053174c SHA-1: 6871e5263fefe0d50db40fec3f69a2785acce67f SHA-256: 6387575633fb3662d7b067b66cf5ac593734c9b448dcd095cc42d80a03ec7547
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent URL pointing to 'maypoin.ru', suggesting a phishing or spamming operation. The PDF's structure and the presence of many links on disposable hosting also indicate it's part of a link farm, often used for SEO manipulation or to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=directv+guide+title+not+available
    • https://static.s123-cdn-static.com/uploads/4490375/normal_5fe32ec75e00d.pdf
    • https://static.s123-cdn-static.com/uploads/4414174/normal_5ff6a8ad7d50e.pdf
    • http://wanebiwadu.iblogger.org/fomugusipakegivubejagogiv.pdf
    • https://cdn-cms.f-static.net/uploads/4366316/normal_600d4f06b0777.pdf
    • https://cdn-cms.f-static.net/uploads/4480590/normal_604014519a0d9.pdf
    • http://varuzajuv.22web.org/54771498871.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bopuxosavubare/dimikitel.pdf
    • http://sizokipizap.rf.gd/diy_king_pallet_platform_bed.pdf
    • http://babefuv.epizy.com/personality_quiz_esl.pdf
    • https://s3.amazonaws.com/dukavunivifa/colleen_campbell_reporter_instagram.pdf
    • https://s3.amazonaws.com/paxivogedewilu/periodic_table_puzzle_worksheet_answers.pdf
    • https://068ba8bc-08b0-4b68-8151-f3c59c7a5775.filesusr.com/ugd/5a4aad_55f55c88ba0f46488433383611113f7e.pdf?index=true
    • http://fewaxujuwede.rf.gd/branding_your_business.pdf
    • https://61249681-e2d1-4375-841a-b3723294d79c.filesusr.com/ugd/3d514e_44c31d038fa4477d9b16f2284b0befb2.pdf?index=true
    • http://fakatidewejuna.epizy.com/gowuxasotoworuk.pdf
    • http://lirolisol.epizy.com/66179283944.pdf
    • http://bumilamufitilu.epizy.com/10745039661.pdf
    • https://s3.amazonaws.com/luramamelolem/biogen_inc._annual_report.pdf
    • https://101c3d73-5e22-4da1-a203-a3a2a794ce88.filesusr.com/ugd/69a512_758b02d912594743824cf32510dc2a42.pdf?index=true
    • http://tewarenibimek.rf.gd/78669075843.pdf
    • https://abaaaae4-9231-44fc-b12c-ad55ebcc68e7.filesusr.com/ugd/2ca09c_31572e7c8c0d4a28bfe9951e7b62e079.pdf?index=true
    • http://demaketimazo.rf.gd/boboiboy_galactic_heroes_game_apk.pdf
    • https://a001dc82-f31e-4944-9b76-0a8e602b6855.filesusr.com/ugd/e4ee87_2a00184d83da46058e756b090a896f02.pdf?index=true
    • http://fabodatutowew.epizy.com/muzuzorelejutafi.pdf
    • http://xabazuwodumodo.epizy.com/nokerosomotatibam.pdf
    • https://s3.amazonaws.com/vososasoxumete/bufusejebebafuxotipalowe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7cf.bin
3c172925f0aa655e6febcaf23f10ff5563b12f48c519d8f386e14b75730cb747		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7CF 5128 bytes
font_01_sfnt_off0001095a.bin
549ed383346603d524c7c7deefc2da2feaf9e1c119e679673b3d2f18e1cddddb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1095A 11532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.