Malicious PDF — malware analysis report

Static analysis result for SHA-256 668cdc79d12ac29e…

MALICIOUS

PDF

75.5 KB Created: 2021-03-27 12:39:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: f00c5d6fe8dc0a8261cdb04a09550be4 SHA-1: 61d8506ef176a973d8a0a9cafee917ba5c616962 SHA-256: 668cdc79d12ac29eea3e011926e11b7f3bbd1c7b9237e0425f3ac2ae296241b5
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many hosted on disposable domains, suggesting a link farm or SEO spam operation. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically identified as a phishing trojan. The embedded URLs and the document's structure point towards an attempt to redirect users to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=backyardigans+lyrics+espa%25C3%25B1ol PDF link annotation
    • https://bafuzonexive.weebly.com/uploads/1/3/0/7/130739369/loporababu_vazabirawes_negukimololo_nawebewaninu.pdfIn PDF document text
    • https://sojomirolasa.weebly.com/uploads/1/3/4/3/134325131/c61fc.pdfIn PDF document text
    • https://farazekij.weebly.com/uploads/1/3/4/3/134379469/besoxesozabobutewu.pdfIn PDF document text
    • https://lidutefavova.weebly.com/uploads/1/3/4/0/134012516/besujene.pdfIn PDF document text
    • https://bazifimu.weebly.com/uploads/1/3/4/6/134661545/totamo_zuvenumofizo_dupejor_juzab.pdfIn PDF document text
    • http://zekifafeter.scienceontheweb.net/different_types_of_organizational_structures_in_writing.pdfIn PDF document text
    • https://tunilixagipibi.weebly.com/uploads/1/3/5/3/135304468/tabalokexijare.pdfIn PDF document text
    • https://fipokotosa.weebly.com/uploads/1/3/4/5/134506619/ee089b9a0e.pdfIn PDF document text
    • https://zajutarox.weebly.com/uploads/1/3/0/8/130814803/ee94518e9.pdfIn PDF document text
    • https://bobelijanufav.weebly.com/uploads/1/3/5/9/135960041/vebetupaduzazal.pdfIn PDF document text
    • https://fadafiwu.weebly.com/uploads/1/3/5/3/135302778/wabijapapazuvi.pdfIn PDF document text
    • http://noxaduva.mypressonline.com/zowiv.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://569e8712-2873-4b93-a654-ea71b6b809e3.filesusr.com/ugd/345929_35f750171d764a198b48d3cb47ced5cc.pdf?index=trueIn PDF document text
    • https://d115d978-d96a-40c8-9764-5d959708fc35.filesusr.com/ugd/436160_840575e1ba6a4624ae85c1c7ac660471.pdf?index=trueIn PDF document text
    • https://4121a797-204a-431c-92a8-8e24072fb342.filesusr.com/ugd/b972d5_bb13f5d3ad1641eab17c4525e6b35dd5.pdf?index=trueIn PDF document text
    • https://5e9816b5-e261-4a84-a5c7-594b6999e1c8.filesusr.com/ugd/eb2f7d_6328fd1b748e4885b95e35213a707aed.pdf?index=trueIn PDF document text
    • https://f84ffea9-2755-49c2-9cb5-47ca8b55fe65.filesusr.com/ugd/0adedf_19ab4985155d41478588aea31be275fe.pdf?index=trueIn PDF document text
    • https://36fc1fe3-b646-4cc1-b6e9-de51469aea27.filesusr.com/ugd/3eb4bd_33d8f30299f349e0a7daac59cc024661.pdf?index=trueIn PDF document text
    • https://f579be4a-c2ec-451d-94ee-532237c06880.filesusr.com/ugd/9f6a24_2fc1ec8037ee4b7e8a3620c2019f689b.pdf?index=trueIn PDF document text
    • https://933afb0c-60ca-4ff4-ba38-e7c804ca925d.filesusr.com/ugd/941881_f3a2ef79dd694467b639b2c03e9baf62.pdf?index=trueIn PDF document text
    • https://b7d3a0ae-8059-487b-8826-088776693174.filesusr.com/ugd/8d23e4_3d6b56a644d44d44b97fed5f2820524b.pdf?index=trueIn PDF document text
    • https://877305ac-a74e-4e93-918f-f866ec7622df.filesusr.com/ugd/0dac30_7303f9ecfc5f4a4eab3d0464be7e448d.pdf?index=trueIn PDF document text
    • https://f6ce3cfb-f922-470c-9e0e-eaf724001b0e.filesusr.com/ugd/defcb2_5207da6bb95e44c5832f1bb7f50a284d.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7CB 3984 bytes
SHA-256: 4d16fb4a2710c69d1f93de362c0b36526077140ae0ceb902cb0d552b295baf82
font_01_sfnt_off0000e5dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5DD 5668 bytes
SHA-256: bb01c86d5130fbfc3c80cf221a8ff77ea89b0c686efb2869bbe9dde64af580ec
font_02_sfnt_off0000f904.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF904 11324 bytes
SHA-256: 90b1e6056e1eb8622d6af8c545a2d8a15bda808c26977b59967111cd5f22af03

Open this report in the interactive analyzer, or submit your own file for analysis.