Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ef008ca8c5e7297…

MALICIOUS

PDF

105.1 KB Created: 2021-04-02 09:10:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: a1aa793ea1582b584279d60406fac763 SHA-1: 506cb19da2b72ae12a3d17d12ca089e69944f679 SHA-256: 6ef008ca8c5e7297d4edc449b8446543044a7b92eaed9c8deae50f02035c54fd
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and numerous external URIs suggest it's designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9965

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=geometry+dimensions+and+tolerance+pdf PDF link annotation
    • https://gedexezesojefib.weebly.com/uploads/1/3/4/6/134666283/jaraxogiruxaf-zunibis-kuwobigifaxeb-fikazidab.pdfIn PDF document text
    • https://topizamo.weebly.com/uploads/1/3/4/4/134435864/8e147.pdfIn PDF document text
    • https://wadidomewagu.weebly.com/uploads/1/3/2/6/132681938/6397978.pdfIn PDF document text
    • https://bubijusafas.weebly.com/uploads/1/3/5/9/135994311/bemuj.pdfIn PDF document text
    • http://noxogejukebe.mypressonline.com/appareil_respiratoire_de_l_homme.pdfIn PDF document text
    • https://losanuritajog.weebly.com/uploads/1/3/4/7/134730792/30f37b0.pdfIn PDF document text
    • https://nigapabibaba.weebly.com/uploads/1/3/4/9/134903053/ac92212.pdfIn PDF document text
    • https://natuxebifenukud.weebly.com/uploads/1/3/1/3/131378868/poviruledefasovi.pdfIn PDF document text
    • https://malosopiwa.weebly.com/uploads/1/3/2/6/132695478/zepubedubo.pdfIn PDF document text
    • https://logutidukikov.weebly.com/uploads/1/3/1/3/131380383/lonizaniba_pidup.pdfIn PDF document text
    • http://jipetabonitu.mywebcommunity.org/55865771391.pdfIn PDF document text
    • https://pumijisiror.weebly.com/uploads/1/3/1/3/131381241/vejujafire-komeka-zifowa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/buponuwebi/24550974682.pdfIn PDF document text
    • https://9aef9be9-4304-4ec6-b02b-ded1eabc5d1b.filesusr.com/ugd/a571b8_c29f963fe43a4232a6f746b5e65dc406.pdf?index=trueIn PDF document text
    • https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_6ad8f54a2360488cae8fceaf2505064f.pdf?index=trueIn PDF document text
    • https://92e0cadd-ca3c-497d-ba7d-1aece6ee6da0.filesusr.com/ugd/008e52_056e76bb39c54a598e44e444808f7d09.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bivanud/gewubimedubapegukuwema.pdfIn PDF document text
    • https://s3.amazonaws.com/wizidimawag/sozaxefaki.pdfIn PDF document text
    • https://s3.amazonaws.com/nawosineromigi/cheer_dance_music.pdfIn PDF document text
    • https://d2d87fd5-5f4d-49aa-ab3c-2263ce4b5d22.filesusr.com/ugd/9169d2_55b1b49c09ee4adca225872db59ae019.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tapelu/essential_university_physics_volume_1_3rd_edition.pdfIn PDF document text
    • https://34184745-b1ec-4725-b105-60c94cc90871.filesusr.com/ugd/63369f_b9ba36682eee4853871e785879a919c5.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010db3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DB3 6620 bytes
SHA-256: 7177fb38fd39ef8b4dd94c61545f1662c25de96666c249f03ca9cf7a6f095c66
font_01_sfnt_off00011e33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E33 4556 bytes
SHA-256: 4b7ecf5fee6b23524c884f95e99e0dd2341922e8a24793dd818c721c33bc31e4
font_02_sfnt_off00012b55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B55 5436 bytes
SHA-256: c3f95bbd945f261404f429ef2e0915871af06c3c443fc619992c0c5a0d3490ee
font_03_sfnt_off00013d88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D88 6244 bytes
SHA-256: c3b7616c677f31bc086106296eeb3929f7fd66fa092094a0fff2713cde01cefa
font_04_sfnt_off00014cbf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14CBF 1900 bytes
SHA-256: 6d90673cd6d43771d07d73ce88608e79dda3a7c21d79eb2ab8f7afb86c456f92
font_05_sfnt_off000155f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x155F9 11592 bytes
SHA-256: bd1119b3f32d796e32e6ceac910f2e6444b9a14375f8a663e3a4e794216ba965
font_06_sfnt_off00017ddf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17DDF 16520 bytes
SHA-256: 9f2e2f831b824c815ccc63b06dd6adca264add0a0ef58bf6c5bad30c62010b89

Open this report in the interactive analyzer, or submit your own file for analysis.