Malicious PDF — malware analysis report

Static analysis result for SHA-256 6beb8316d009cc39…

MALICIOUS

PDF

70.5 KB Created: 2021-10-03 15:48:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 6655859cc18432a9e33bb3060d1e6f69 SHA-1: 4027021719797f7078a27ff4d77d785ef4e55638 SHA-256: 6beb8316d009cc390554cac1d44e3d2a4f4416b3ec0c8214bb2e1e42b0064ac2
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was identified as malicious by ClamAV and an ML classifier, with multiple heuristics indicating it functions as a link farm. The PDF contains numerous embedded URLs pointing to potentially malicious domains, suggesting a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and heuristic firings strongly suggest an intent to redirect users to external, untrusted content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/uplcv?utm_term=turn+the+lights+off+carry+me+home PDF link annotation
    • http://baovecongtruong.com/upload/files/litavu.pdfIn PDF document text
    • https://history.tlshaa.org.tw/ckfinder/userfiles/files/87185527967.pdfIn PDF document text
    • https://fminterativa.net/cms/plugins/ckfinder/userfiles/files/nufuravopuneletanof.pdfIn PDF document text
    • http://secretsocietygroup.com/temp/vinney/HTML/userfiles/file/jufuzazunipigugixozur.pdfIn PDF document text
    • http://fialki.su/miwezudarigig.pdfIn PDF document text
    • https://www.cylinder96.ru/admin/ckfinder/userfiles/files/vutofumudu.pdfIn PDF document text
    • https://pomacanthe-art.fr/imagebeforeafter/files/dijowej.pdfIn PDF document text
    • http://cristal-in.fr/userfiles/file/88607023865.pdfIn PDF document text
    • http://apnschool.in/singhania/downloads/file/56201060008.pdfIn PDF document text
    • http://www.gieskestukadoors.nl/ckfinder/files/files/tololorevufafizam.pdfIn PDF document text
    • http://hftyby.com/upload_fck/file/2021-9-17/20210917041642944086.pdfIn PDF document text
    • http://ymmicro.com/files/files/62573564581.pdfIn PDF document text
    • http://tianlanip.com/filespath/files/20210927094318.pdfIn PDF document text
    • https://www.tyrtaios.gr/ckfinder/userfiles/files/55673290518.pdfIn PDF document text
    • http://gzafjc.com/uploadfile/files/fimigekumigetesa.pdfIn PDF document text
    • https://doctmcooper.com/userfiles/files/numexutulakuxevipon.pdfIn PDF document text
    • http://avtosfera28.ru/userfiles/file/77201669305.pdfIn PDF document text
    • http://progettarecasa.com/userfiles/files/61126722711.pdfIn PDF document text
    • http://johnlillylaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/kibefogebofud.pdfIn PDF document text
    • https://sydneystudytour.com/accounting/userfiles/file/85584912569.pdfIn PDF document text
    • http://saothienemb.com/uploads/images/files/14378613164.pdfIn PDF document text
    • http://likebarcode.com/image/files/20210922_131542.pdfIn PDF document text
    • http://methese.com/upload/files/96790216484.pdfIn PDF document text
    • http://vip-cond.ru/userfiles/file/ziriselumizuzi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b22d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB22D 16068 bytes
SHA-256: 1eaf6c33726f8f6b3f2adf02c91776ce141f051d7784d9bac11fe27b784e69ab
font_01_sfnt_off0000dae8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAE8 10960 bytes
SHA-256: ea83aca0b86c6ebbf464029c7221caeffb639642f54b781f8ffea0aabf4d2883
font_02_sfnt_off0000f431.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF431 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.