Malicious PDF — malware analysis report

Static analysis result for SHA-256 716baeb5eee02ab6…

MALICIOUS

PDF

73.8 KB Created: 2021-03-24 00:19:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-28
MD5: 7e5e479f24c8d10abe31948558019cd9 SHA-1: 58b6371e951f1104c9d62e5353d870154a6d98e8 SHA-256: 716baeb5eee02ab6155320c57deeb037696e912a62d4be683acb0826f5af918e
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many pointing to disposable domains, as indicated by the PDF_SEO_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM heuristics. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or distributing further malware. The primary URL, https://mezovuduw.ru/wix?keyword=tappan+microwave+tmv151fs, appears to be a keyword-driven redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=tappan+microwave+tmv151fs PDF link annotation
    • http://tatemegedes.sportsontheweb.net/christmas_carol_songs.pdfIn PDF document text
    • https://cdn.sqhk.co/zezinojox/eFiaBQw/fivodozogasovuxedutav.pdfIn PDF document text
    • http://malespw.xyz/5031466459ka1hb.pdfIn PDF document text
    • http://tryraisins.pro/navy_blue_faux_leather_jacket_womensuhg7w.pdfIn PDF document text
    • https://cdn.sqhk.co/larivowap/jeMj2hd/rodutipimipojumipepo.pdfIn PDF document text
    • https://cdn.sqhk.co/solijisivono/auRiije/pelitejap.pdfIn PDF document text
    • http://rijoginijamibeg.mypressonline.com/how_to_write_recommendation_letter_for_scholarship.pdfIn PDF document text
    • http://dududuw.mypressonline.com/fepunetedixaz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://c33c3ce4-fa2f-4f19-9477-7a801b41b29e.filesusr.com/ugd/ebbcbd_78341d42e7514f5daaffd7fe4678f573.pdf?index=trueIn PDF document text
    • https://e8f98835-b194-42a5-b43f-fe2f29920dd6.filesusr.com/ugd/bf650e_d29cb05a990e4d08a9910e7cadf7e860.pdf?index=trueIn PDF document text
    • https://cd70d4e5-4a1a-4071-96d1-f2415ea5ece1.filesusr.com/ugd/7f46b5_360bce97e45542cab4a2ab1fd464241a.pdf?index=trueIn PDF document text
    • https://528f6e5c-6927-42ef-b7a5-a8f9c349750c.filesusr.com/ugd/07b979_92b5598e585f4ec692c07356fca629fa.pdf?index=trueIn PDF document text
    • https://e4fb9bf1-a3d6-4767-9bf2-2a1021e5dc09.filesusr.com/ugd/53cfc7_6032a02540984ca091c2d62f88ecbf83.pdf?index=trueIn PDF document text
    • https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_4db34162d9b2489689166f9e0104b225.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/99bd456b-1f23-42af-badc-21762c2dab50/jawivobumipuj.pdfIn PDF document text
    • https://59cf682b-6680-4a08-8b8d-0472bab64ef7.filesusr.com/ugd/d7d6cd_d4cd0f4bf9a945469ab8a42447395e84.pdf?index=trueIn PDF document text
    • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_112814ede9f6445987745fd3e20b4234.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ae7fe71-04f4-41c7-a958-52d4218f4434/14555720834.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c1ff45c-c7c8-4fda-b48c-7ae28771d6d0/pepisikexuvijidavu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fe8752a-c2f0-46c7-81b7-1c00c1764fcb/puwarapad.pdfIn PDF document text
    • https://1f49b3f1-4b09-4f89-88df-03804352fc9a.filesusr.com/ugd/a51aec_b94b7d8fc71149a183d4a7468175feb7.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3DF 5192 bytes
SHA-256: 9710ae27cb26c02d3e197c44611a70bab5bc25e3159f6f637eddf415b29e08bb
font_01_sfnt_off0000e584.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE584 11368 bytes
SHA-256: d37bc5727de6aa0ff5d76a52dcd9ff55d8b62d79c507f9305890e02bd71d0199
font_02_sfnt_off00010c1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C1C 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.