Malicious PDF — malware analysis report

Static analysis result for SHA-256 639f04c66a35a97b…

MALICIOUS

PDF

118.2 KB Created: 2021-05-16 19:14:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: b7f4cdb08c5c75e9418858073812e909 SHA-1: 071e22ee0e84eef777e03a8502fb5769ce520493 SHA-256: 639f04c66a35a97b965d386d4e1c5a5ae90f82f7cc7455f1658e82c8fc672809
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with a significant heuristic firing indicating it's a link farm on disposable hosting. One prominent URL, 'https://jumiwimov.ru/strik?utm_term=cuando+martin+lutero+escribio+las+95+tesis', is flagged as external and likely malicious. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware delivery via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=cuando+martin+lutero+escribio+las+95+tesis PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4376354/normal_5fe4347d63ef1.pdfIn PDF document text
    • https://cdn.sqhk.co/bafiweba/XgcTfjj/parents_kit_app_reviews.pdfIn PDF document text
    • http://www-sfr-fr-monespace.com/kiwilafigifitudiginotib9rn3l.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476756/normal_5fe1ea0ac2ff3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368478/normal_5fe33c8840d36.pdfIn PDF document text
    • http://idealica-uficiale.website/videoder_apk_download_para_pccnuk8.pdfIn PDF document text
    • https://cdn.sqhk.co/difanemifal/T8gdjdI/15398548418.pdfIn PDF document text
    • https://cdn.sqhk.co/bupabumo/7Qkjahg/modejenut.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413345/normal_5fd9045611b94.pdfIn PDF document text
    • http://gatorama.fun/how_to_use_thermador_speed_ovenr5ioq.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tiduro/reduce_to_canonical_form_pde.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c14b7f27-1163-491e-9e31-c4949c2384a8/62116417199.pdfIn PDF document text
    • https://s3.amazonaws.com/wusone/nj_boater_safety_course_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1ed84f3-ad9e-41da-ae0b-7ca39e7bd177/samsung_soundbar_hw-h550_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9450620-892a-4384-b3f3-0ba0af20f86f/50506723539.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbfe488e-ae91-4140-a17a-890786054891/nintendo_ds_lite_usb_charger_cable.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017343.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17343 5408 bytes
SHA-256: 53bf77bf198a2e8e25cc57506b9ac5c97d5c6e54c406208d659c7288642a9802
font_01_sfnt_off00018586.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18586 14512 bytes
SHA-256: 7c947f18bbe32c63ebb2528613e8edb4ed7fe06d1628ce45d9d7d0ee684a8ff6
font_02_sfnt_off0001b37b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B37B 16204 bytes
SHA-256: 83b0f3ed90e545d6d36d14a1982d3fe7024877db6cf476e622725167f7eecf28

Open this report in the interactive analyzer, or submit your own file for analysis.