Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e9f47c6c4b50be5…

MALICIOUS

PDF

82.6 KB Created: 2021-04-05 20:15:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 47ec350ff97e2ddde70d5342b102dbc2 SHA-1: bcb54851503e80ba18718f5629ef5d72e3422325 SHA-256: 6e9f47c6c4b50be5dd2d1d2837066c06dfc6b0a2f4b835d0271149e70c11c4eb
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing campaign. The ML classifier and ClamAV detection strongly indicate malicious intent. The document's content, disguised as a user manual, is likely a lure to direct users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=titan+440+user+manual
    • https://tavovoxiwazufaj.weebly.com/uploads/1/3/5/3/135325502/vavosomawikaba.pdf
    • http://kowojolajamuv.getenjoyment.net/how_fast_is_a_model_3_dual_motor.pdf
    • http://bamasadukarudam.iblogger.org/ireport_group_header.pdf
    • https://figapizezedop.weebly.com/uploads/1/3/4/3/134364787/mixof-xijebamafajafas.pdf
    • https://gikositaga.weebly.com/uploads/1/3/4/7/134773380/dd2af184162ec2.pdf
    • http://zawoxilejaku.66ghz.com/zupisujolifozefegazo.pdf
    • https://toxobeveja.weebly.com/uploads/1/3/1/4/131437160/3298453.pdf
    • https://rajikaluniker.weebly.com/uploads/1/3/1/3/131383998/169474.pdf
    • https://bubafoxir.weebly.com/uploads/1/3/0/8/130874260/jexurifafita.pdf
    • http://banuduxirodeb.mypressonline.com/something_anything_someone_anyone_somewhere_anywhere_exercise.pdf
    • https://tadeganerusoza.weebly.com/uploads/1/3/1/4/131438541/xigito.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://gogujigasad.onlinewebshop.net/jewaneke.pdf
    • http://kutelitowolobe.rf.gd/nelezivoxanimuwopanu.pdf
    • https://9e1e9198-0fe7-4103-8084-fdcc6befb8d5.filesusr.com/ugd/2f7815_d9f175ac44464853b154b9d9cf827f35.pdf?index=true
    • https://75e6061f-eb7a-4ce8-b546-077bf96366c3.filesusr.com/ugd/2dfd19_7f28bc3d09ca42c09e7226c4a83f6636.pdf?index=true
    • https://d128792e-e0a8-46e0-98ed-b941f5da69b2.filesusr.com/ugd/b98abb_5ae031ed840a4bfa9280b55801e53df9.pdf?index=true
    • https://878ee1be-828d-48b9-a24a-84283cf66a1c.filesusr.com/ugd/86936c_6024faa0a8224f6b92276c2c924b5afb.pdf?index=true
    • http://dulubuli.rf.gd/28169982497.pdf
    • http://wawikoduvebakap.onlinewebshop.net/since_already_just_yet_exercises.pdf
    • http://rabelinowizufe.myartsonline.com/latidewan.pdf
    • https://667b589a-70dd-4c78-a03f-47f6e9f07b1f.filesusr.com/ugd/db80c5_36df70cbfd7d4f8b84e65116c83c4ac7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f929.bin
64b50d154a54d5abddb6ce1af852c040a9ad871dfcc2293e874017f827d65b11		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF929 4780 bytes
font_01_sfnt_off0001093f.bin
9f3de758a87b042ca62f55d1075f6a1b8b4918d52fbd2af2b33ab5a46c70b774		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1093F 10984 bytes
font_02_sfnt_off00012eb3.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EB3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.