Malicious PDF — malware analysis report

Static analysis result for SHA-256 679a69271c2d8ae8…

MALICIOUS

PDF

75.1 KB Created: 2021-04-02 13:20:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: bd9423ff44b9b628ab23b3810f7fa3f3 SHA-1: 20f971508fe94799ae43b6f8f1f86f8148d88efb SHA-256: 679a69271c2d8ae86f48a891881de36332562b47a4b634cdf11076b6f2b0aece
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded links, many of which point to disposable hosting or are part of a link farm, suggesting a phishing or SEO poisoning attempt. The primary lure appears to be a guide on 'how to light up the water heater', which redirects to a suspicious URL. While no scripts were directly extracted, the PDF structure and heuristic firings indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+light+up+the+water+heater PDF link annotation
    • https://cdn.sqhk.co/vekosozob/iigehaz/knife_wielding_crab.pdfIn PDF document text
    • http://wapividazofar.scienceontheweb.net/kojidolakojava.pdfIn PDF document text
    • https://cdn.sqhk.co/pigevikuwi/dcQPdGY/gebitegubi.pdfIn PDF document text
    • https://cdn.sqhk.co/xinefegepe/ipifyGs/rirebamos.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pizivurapab/xeligowe.pdfIn PDF document text
    • https://3f740848-0e57-4b51-8596-564812021bec.filesusr.com/ugd/cbe17c_bb9ba2839ad548b98d125c8f1750d1eb.pdf?index=trueIn PDF document text
    • https://ec8c99fd-5413-4e38-b6a0-2ccbba71fc6f.filesusr.com/ugd/de02f3_cce96dbdeea8414796c8133fbfb47a82.pdf?index=trueIn PDF document text
    • https://83662c7a-80c1-4e94-b5a4-3df479670d58.filesusr.com/ugd/27be29_130bf72efddb441c8a072600f10bba2b.pdf?index=trueIn PDF document text
    • https://7211abc3-b26e-437e-abd8-8a8c7ebd4af5.filesusr.com/ugd/0683fb_7e198fdbae4c4673a7df7b0d79af1de5.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xirixepo/ginilirud.pdfIn PDF document text
    • https://s3.amazonaws.com/jaxesabi/xexeti.pdfIn PDF document text
    • https://eae964be-cf9f-49a8-9b2f-00020d526acb.filesusr.com/ugd/e932cf_38dd6d3b606742f8aec7ca5b48aa525e.pdf?index=trueIn PDF document text
    • https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_8d4b0eeb9ac847798554bc054bc4ed4d.pdf?index=trueIn PDF document text
    • https://ce3a146a-d504-4efb-981c-4593fb85d965.filesusr.com/ugd/5b5da7_4f825cf2474f434eb2b668959807abb6.pdf?index=trueIn PDF document text
    • https://ad843f61-c544-48d7-8cfb-3c048b9edb46.filesusr.com/ugd/0dd9ed_295c64429d2a4f74b79589613173dd60.pdf?index=trueIn PDF document text
    • http://samesesodore.onlinewebshop.net/14247264753.pdfIn PDF document text
    • https://cb2d4818-2134-4ea5-ae57-1bc45cfc4292.filesusr.com/ugd/7e787c_4c8748634a794cf6a1c7b790ad8ecf82.pdf?index=trueIn PDF document text
    • https://36425c1f-c329-48aa-845d-1f8252cb45c8.filesusr.com/ugd/01d500_194cafbb0cac4c5aad4300e874eaee26.pdf?index=trueIn PDF document text
    • http://sefokirof.onlinewebshop.net/plant_mutation_breeding_and_biotechnology.pdfIn PDF document text
    • https://f0ded7c6-1882-44c2-b580-3fd8daacf182.filesusr.com/ugd/1cd4ca_35f3cc77076f445a92ecfef8eba16c44.pdf?index=trueIn PDF document text
    • https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_97b82d9998104ffb842852fc56d86a05.pdf?index=trueIn PDF document text
    • https://0108a07e-94d6-443d-bfa7-575dd38852ad.filesusr.com/ugd/756a01_e081d80cc0774acda4ab3e19bdcd5c06.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tamobalasu/16237751520.pdfIn PDF document text
    • https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_f617429227924d7d81561b64b0ff9a09.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA0D 4956 bytes
SHA-256: e56affd6bf4d1c2ccad3aa66b3f646b89cad1bd88a8a7eb63c2129ef40550be3
font_01_sfnt_off0000faf5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAF5 10596 bytes
SHA-256: 5c64497b56229a0aaefbd1d4ad8816f596d93dee3d4828d7f0d1bf4d535fdbf6

Open this report in the interactive analyzer, or submit your own file for analysis.