Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dc53523b83cb7d8…

MALICIOUS

PDF

75.3 KB Created: 2021-03-04 02:40:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: e806e4f9d1f1a93d426c9f7fdc637bb8 SHA-1: 72a172c5b92e3457d1a792e8f0eaa3d2ca676dd0 SHA-256: 6dc53523b83cb7d8ed331286e91bd5262e10b6cf7dfa95dfa6d509af4b793a95
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8746

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=.net+tutorial+for+beginners+with+examples PDF link annotation
    • https://noremovex.weebly.com/uploads/1/3/4/8/134883944/1675197.pdfIn PDF document text
    • https://riwozetamozu.weebly.com/uploads/1/3/4/3/134331456/4489512.pdfIn PDF document text
    • https://liwifaxuje.weebly.com/uploads/1/3/0/8/130874244/80a1a63.pdfIn PDF document text
    • https://duvozeja.weebly.com/uploads/1/3/0/7/130739152/3b70e12b241c99.pdfIn PDF document text
    • https://dixamagajo.weebly.com/uploads/1/3/4/6/134652312/puxori.pdfIn PDF document text
    • https://momiweporav.weebly.com/uploads/1/3/4/7/134745900/fumigetak.pdfIn PDF document text
    • http://zajiledafalam.getenjoyment.net/xurusuvulukasoj.pdfIn PDF document text
    • https://kuburabet.weebly.com/uploads/1/3/4/3/134362545/jubedafe.pdfIn PDF document text
    • https://fuwupizur.weebly.com/uploads/1/3/5/3/135390256/3744226.pdfIn PDF document text
    • https://kifesajisibak.weebly.com/uploads/1/3/4/8/134884742/10386231b0da8.pdfIn PDF document text
    • https://sezorataxij.weebly.com/uploads/1/3/4/6/134600708/0972ee.pdfIn PDF document text
    • https://finijigif.weebly.com/uploads/1/3/2/6/132681422/naririwu_gazivuzo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/polojuliragam/fozusakefeviwaf.pdfIn PDF document text
    • https://s3.amazonaws.com/xebuvuwov/sodovinavijenem.pdfIn PDF document text
    • http://lozekav.epizy.com/onerepublic_start_again_song.pdfIn PDF document text
    • http://rewifavad.epizy.com/balloon_telugu_full_movie_free.pdfIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1E3 6568 bytes
SHA-256: 792e288023e4fbe73a0351c4e4cf94c19217598e688914c0413f09f13c1160d5
font_01_sfnt_off0000f230.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF230 5552 bytes
SHA-256: 0f02ce396b7bffac69357295bd379fe1b024919bf312efab2388e9d3a504b900
font_02_sfnt_off000104f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104F5 2156 bytes
SHA-256: 007c3ee2dfa9e918f0b63d131880cf64088e0026b4edad393e9cee4a4ac7a198

Open this report in the interactive analyzer, or submit your own file for analysis.