Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a64f115e735a496…

MALICIOUS

PDF

80.1 KB Created: 2021-04-11 23:59:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: cd3566ec3e575648402d144741c4486f SHA-1: 446b5967f57f492864b09118e14dfd47d7f2ce8a SHA-256: 6a64f115e735a496e4ac28d2708c5dd7f9ce3d06c1c5c088d61d42d90c445bdd
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many pointing to disposable hosting, and includes a URL that appears to be a lure for driver's license renewal information. This structure is indicative of a link farm designed to direct users to potentially malicious sites. The ML classifier and ClamAV detection strongly support its malicious nature, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+do+i+renew+my+ma+driver%2527s+license+online PDF link annotation
    • https://zopokobo.weebly.com/uploads/1/3/1/3/131383813/pefoda.pdfIn PDF document text
    • https://migigagabigugam.weebly.com/uploads/1/3/0/7/130775968/1743538.pdfIn PDF document text
    • http://wdd13.ru/baritone_saxophone_sheet_musicfzb36.pdfIn PDF document text
    • https://raxagipob.weebly.com/uploads/1/3/4/8/134883443/suzeturuborururik.pdfIn PDF document text
    • http://mon-cmb.best/7914152389wxf9e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://00c0516a-c822-4344-a779-6f74e039753d.filesusr.com/ugd/9e41f0_3d14a0f32a61498494f3dbdfff71f239.pdf?index=trueIn PDF document text
    • https://9cc03a5b-da86-4a44-8f3d-15f7580f9586.filesusr.com/ugd/cac91c_d3305cb5c16e4595ad5a407104aa45d6.pdf?index=trueIn PDF document text
    • https://3dcfbd4a-ef33-49dc-a04a-0aaf5307c30d.filesusr.com/ugd/b47706_dbe85942d5cf4d558950741f8e12a4ff.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/449849e5-e7de-44be-9ab5-e62ff5212c19/xifidi.pdfIn PDF document text
    • https://184d393c-d2ff-49e5-bbcb-48626b1dbf88.filesusr.com/ugd/49be48_ba49b30f66984f9491519458e4bf42d5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e3fa1c5-bffd-4ac3-98c0-19e93b705a0f/2018_subaru_forester_2.0xt_touring_price.pdfIn PDF document text
    • https://170d08c7-2527-4f8e-8bc4-cf7f6ffab704.filesusr.com/ugd/afe24e_976a12a9c3c2475287e88b41382c5610.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/74143950-1697-4998-86bc-8a72ac1f3e9e/bunker_hill_safe_key.pdfIn PDF document text
    • https://a49ec80b-b4e3-4dac-84ed-d687b6aff6a5.filesusr.com/ugd/46d696_49e51eb4524f44ae814bfc3b518610e1.pdf?index=trueIn PDF document text
    • https://ced6af22-cf5f-4df0-9cd6-2d424634d287.filesusr.com/ugd/3eed2b_deda5835fe7d46bf9b68a1ab751821ac.pdf?index=trueIn PDF document text
    • https://058da8ce-bb30-4b8c-81eb-8903018cac65.filesusr.com/ugd/ab745b_a7c9ce2ac4e14861b98fc880bedfb5cd.pdf?index=trueIn PDF document text
    • https://e5baaea7-7007-41de-9367-4ebf3ed55875.filesusr.com/ugd/8e1900_522466b97bc2459b9266ef219bbc3ec9.pdf?index=trueIn PDF document text
    • https://7162f0c1-3bb2-4775-9ad2-1e34613fb889.filesusr.com/ugd/595093_b1b56ace51c745ebaf497cb36c1ffc7e.pdf?index=trueIn PDF document text
    • https://a26b494c-4f54-4b9d-aaa3-e02d462d315a.filesusr.com/ugd/c6268f_b412a05eba8f4d11b4d42a051d162581.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edcc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDCC 5044 bytes
SHA-256: a85f601f71bd8f2457b3c0e7a05d9a0d57e65ca997f7e3e78aa77e7b429c34b5
font_01_sfnt_off0000fee9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEE9 11164 bytes
SHA-256: 9e987fe0323f7b43d1e4a996fc89789a27e35b9cb8e8f01e9c865b756dc87310
font_02_sfnt_off000124da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124DA 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.