Malicious PDF — malware analysis report

Static analysis result for SHA-256 67039c2859f7c06a…

MALICIOUS

PDF

99.7 KB Created: 2021-05-09 21:20:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 591e38a1fc6116bc318ffe5f31c683fe SHA-1: 9c9aa88e2847c61bd44a5dc32a5a1b9b786c4b6a SHA-256: 67039c2859f7c06a96e81e93d6a7550c0c101b05e6f7a9f43058c18a73d95854
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are SEO-redirectors designed to lead users to phishing sites, as indicated by the 'PDF_SEO_LINK_FARM' and 'PDF_SEO_UTM_REDIRECTOR_LINK' heuristics. The primary malicious URL identified is 'https://golowaki.ru/strik?utm_term=remington+electric+chainsaw+parts+diagram', which is presented as a parts diagram but likely leads to a phishing attempt. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9841

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=remington+electric+chainsaw+parts+diagram PDF link annotation
    • http://kusufuxufatup.getenjoyment.net/body_dysmorphic_disorder_treatment_manual.pdfIn PDF document text
    • http://janizejekifajab.medianewsonline.com/manual_actividades_auxiliares_de_comercio.pdfIn PDF document text
    • http://vseti.life/borland_delphi_7._0_gratisxj68d.pdfIn PDF document text
    • http://takovod.66ghz.com/11676367299.pdfIn PDF document text
    • http://waferaboteb.mypressonline.com/coliformes_termotolerantes_em_alimentos.pdfIn PDF document text
    • http://info-pages.ru/car_runs_over_protesters_in_new_york_cityqlsnn.pdfIn PDF document text
    • http://sifisomatexow.sportsontheweb.net/64600298301.pdfIn PDF document text
    • http://manovina.mypressonline.com/gloria_anzaldua_borderlands.pdfIn PDF document text
    • http://reetodo.online/how_to_remove_agitator_on_kenmore_washerb6su4.pdfIn PDF document text
    • http://tevajevidiwa.22web.org/84097793728.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fizaxo/bbc_health_report.pdfIn PDF document text
    • https://s3.amazonaws.com/xoferuzu/assassin_s_creed_black_flag_trainer.pdfIn PDF document text
    • https://3cd6846c-369c-4875-9c63-132df726a2dd.filesusr.com/ugd/7ab50f_3a49d57130e84962ad1b18344aa4e7de.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/luramamelolem/86195502578.pdfIn PDF document text
    • https://af4bb04d-41a2-413c-b691-ce0a46ff998d.filesusr.com/ugd/e677f8_4f1b95b6eea9413d9e9346dd48e4e07c.pdf?index=trueIn PDF document text
    • https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_8a0a703e9b6d45d5bdcfc8d5762616c6.pdf?index=trueIn PDF document text
    • https://f4a80ce2-0a24-44e2-aff7-13c87a434ee9.filesusr.com/ugd/ace063_c7ea701252ee4be9a1b49d318483ab19.pdf?index=trueIn PDF document text
    • http://dusetelonuzaj.epizy.com/fijovagenepusesobotetoma.pdfIn PDF document text
    • https://01d67eed-50ba-4ccb-8f82-c1581f7ed07e.filesusr.com/ugd/e3325f_a483b3512510464eb68f7954abe4bb6b.pdf?index=trueIn PDF document text
    • https://a12a05ab-6462-4855-b086-b0a2a961d6d8.filesusr.com/ugd/2c76f4_d051eeb1066c4e1dbdab4a7c82de93bf.pdf?index=trueIn PDF document text
    • https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_9ff5e118517d4677a82246cf7bcade33.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/perurulexi/vewuvasuvoru.pdfIn PDF document text
    • https://c480cc3d-c044-45b7-a7fa-747782367dcd.filesusr.com/ugd/a26f59_466fdaa64536437c91518c922cca2bbe.pdf?index=trueIn PDF document text
    • http://lufafutogixafu.rf.gd/arnuity_ellipta_prescribing_information.pdfIn PDF document text
    • https://cd753cf5-d90a-4073-9c55-931a76e81761.filesusr.com/ugd/8826df_7748d836a08349d099e45b83811d2772.pdf?index=trueIn PDF document text
    • https://bdee3e82-1fe6-4084-b289-f15f5249f83e.filesusr.com/ugd/749937_817de6bf493c43a4b9db9d036de3fcf8.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6EE 6416 bytes
SHA-256: 62deedb54aaef669db635f4ef87d4bda5d475a8bf20633d6b56d9e4ab12fd410
font_01_sfnt_off000106c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106C3 5584 bytes
SHA-256: 7168eb5b0bd89efd1f377b1165ec67fd61f7e7adc1c2e4237ff1f46711278236
font_02_sfnt_off000119a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119A1 10752 bytes
SHA-256: 0d5708ca33dfd01521177e2184bb13926b4607c906e60f2c4c4e1e51cca16020
font_03_sfnt_off00013be3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13BE3 11232 bytes
SHA-256: 314c6d55a3c43f93faad7f6270d542567f5998f20e6573015df98c7ec0712c06
font_04_sfnt_off0001627b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1627B 16256 bytes
SHA-256: ade860a384e0436df56bb84eeed4a9486ec680d7c8981cdb0c3745c5e2239263
font_05_sfnt_off000177d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x177D6 1736 bytes
SHA-256: 74be5bc4d46f64e5c506ae1006f7022dc98ebf960e37c7bf417c2027ca73106d

Open this report in the interactive analyzer, or submit your own file for analysis.