Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d1db27c040a654e…

MALICIOUS

PDF

100.5 KB Created: 2021-05-27 08:17:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 14238c2e1d48f364b67b4cf761ad16d6 SHA-1: e3d09fc011387f6744827f80ad7a300be75b892d SHA-256: 6d1db27c040a654ee44dfc6080822bed7e769154cd3048378a54ebdffa121611
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file identified as malicious by ClamAV and an ML classifier. It contains a significant number of embedded URLs, with at least one identified as a malicious redirector. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external PDF links, suggesting a link farm designed to manipulate search engine results or distribute malicious content. The primary attack pattern involves luring users to malicious sites via these embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=diferencias+entre+celulas+animales+y+vegetales+pdf In PDF document text
    • https://lovefuzabuzonif.weebly.com/uploads/1/3/4/1/134109130/fezumis-gutipabe-bebozulisivesu-vojoda.pdfIn PDF document text
    • https://nuvafuriwevejuf.weebly.com/uploads/1/3/2/8/132814848/5323220.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418574/normal_605a6d7769a6b.pdfIn PDF document text
    • https://xutareziwax.weebly.com/uploads/1/3/5/3/135327408/697e5a52d486.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410953/normal_6036d0a475f84.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417308/normal_5fc5edb76d736.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497650/normal_6037ffd012f4b.pdfIn PDF document text
    • https://rufamuvobaj.weebly.com/uploads/1/3/4/7/134720601/gupojukovuvik-fexuxivoxa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479932/normal_605524f7605d4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/671c0fc8-259e-49e2-b1cd-b72f57d75799/black_and_decker_dustbuster_14.4v_chv1408.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f7c920b-80a4-45e9-b620-d040a1c5ada4/sherlock_holmes_book_of_shadows.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc615864-3c99-4467-b64c-8d42368b9a80/coin_master_free_spins_cheats.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2d4ac51-5b1f-4c41-8093-76262931a832/bataveveguwiga.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f929a907-0999-4bf2-9a75-44357c35ae9a/how_to_set_an_aprilaire_thermostat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abde4c5f-7ca1-47b6-9591-1db53f475adf/roxotovafadibom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3daa33f-2bf2-488a-b9fa-6a4403093a2e/luraxolomitasuzo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/410b23ed-7174-4a47-8db0-1ee6c138381a/mixing_and_mastering_in_fl_studio_20.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f60bac2-f01e-452b-978b-999e9e46a344/24965636962.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/645365a3-7b0f-45a0-a661-b449c5bcf1ae/best_buy_ps5_controller.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59aa1705-3fa6-4523-b6dd-6841d4ab70fe/844459471.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ba068ae-d630-48f0-af8c-494003de3acd/22915503989.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea207bb0-b599-47ec-be55-9d1ba5b35a4d/wixirodex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47f4dd3d-ac5c-4af4-b110-4ef351f70c50/89257795862.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d275662d-20df-4bcd-9aef-44cd64d83d1b/introduction_to_linguistics_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5566ae0d-95b6-41ca-b936-cc3c300f56a5/98469417996.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014551.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14551 5636 bytes
SHA-256: fcc69dd39dd303f9302f3730f6cee82b2522f0f9977faa8e3bfbde411d8764d4
font_01_sfnt_off0001587c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1587C 12956 bytes
SHA-256: b120f52b4528d82169a1e32f20cb655aab03a3d261dd99cf3e918bacfdfe18a3

Open this report in the interactive analyzer, or submit your own file for analysis.