Malicious PDF — malware analysis report

Static analysis result for SHA-256 768e403fb179b9d0…

MALICIOUS

PDF

93.3 KB Created: 2021-04-01 01:43:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 8b763621c8e0196c50c50bd60216e3ae SHA-1: d5fd739172375c50772c6822d92d965c64f0c533 SHA-256: 768e403fb179b9d0fda9c772b3f4ec567171bffe0b31175ab28963a490bcf328
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, many of which point to disposable hosting or known malicious redirectors. The heuristic firings indicate this is a malicious redirector and a link farm, suggesting the primary purpose is to direct users to malicious sites. While no scripts were explicitly extracted, the nature of the embedded links and the ClamAV detection strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=caida+libre+de+los+cuerpos+ejercicios+pdf In PDF document text
    • https://bumobuzeki.weebly.com/uploads/1/3/4/4/134477779/bivogonazagisebi.pdfIn PDF document text
    • https://kinofipu.weebly.com/uploads/1/3/4/7/134725163/mirosemipel.pdfIn PDF document text
    • https://gakezepatirana.weebly.com/uploads/1/3/2/7/132712251/1409722.pdfIn PDF document text
    • https://poxolegap.weebly.com/uploads/1/3/1/0/131069824/af842.pdfIn PDF document text
    • https://vumifedesonuzik.weebly.com/uploads/1/3/4/8/134849268/2170311.pdfIn PDF document text
    • http://boviriso.22web.org/infection_control_plan_template_for_dental_office.pdfIn PDF document text
    • https://kobipisi.weebly.com/uploads/1/3/4/3/134312725/lerutuwojedubu-gumib-gekofugawezifem.pdfIn PDF document text
    • https://raxorevowipafe.weebly.com/uploads/1/3/4/7/134765671/gigejekediwo.pdfIn PDF document text
    • https://gajifawegux.weebly.com/uploads/1/3/4/6/134649352/6977331.pdfIn PDF document text
    • https://satizivuzaked.weebly.com/uploads/1/3/4/3/134383512/vigunevaneganiz-gixogoxidizu.pdfIn PDF document text
    • https://tipowunukal.weebly.com/uploads/1/3/4/3/134355136/5ad064febcd.pdfIn PDF document text
    • https://sifumoxijobobo.weebly.com/uploads/1/3/4/4/134493963/1998113.pdfIn PDF document text
    • http://jidogirikar.mygamesonline.org/chuyn_file_sang_word_b_li_font_ch.pdfIn PDF document text
    • http://sadipize.scienceontheweb.net/84336141512.pdfIn PDF document text
    • https://jipalemidezuf.weebly.com/uploads/1/3/2/6/132681368/5453351.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://vejidot.epizy.com/puwemililakumejo.pdfIn PDF document text
    • https://fa0867c9-8cf0-46f9-bfae-aad8e49c21f3.filesusr.com/ugd/cdba2c_c6132cf86acf43f8829365d19bb9a9ef.pdf?index=trueIn PDF document text
    • https://ef9935f7-a918-44a1-999f-f1d50a45e4a7.filesusr.com/ugd/b463f2_4150ccd239584d67856eb602806af2a0.pdf?index=trueIn PDF document text
    • https://f78a7b13-e75c-4ddc-9f3c-03cd83736f6c.filesusr.com/ugd/90c53f_d8422b3698654c2681b976b47d9c665a.pdf?index=trueIn PDF document text
    • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_1abca37d891747fcb627b201cb107496.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f53a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF53A 6440 bytes
SHA-256: a606a6dede3b99472d2ac97761204782646b5f75106b48d1abccbe9a99ca9a4c
font_01_sfnt_off0001052e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1052E 5268 bytes
SHA-256: 5e32acc269a00088d19c08e19682afc1699520876aafc922ccd7cb1e862ccf4f
font_02_sfnt_off00011718.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11718 3676 bytes
SHA-256: 6e90814a4c74171e1e34ccaefde28bcb9b348ff200f4007328258266ef6adf29
font_03_sfnt_off0001250e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1250E 13048 bytes
SHA-256: ab25fa24bfc5e2bc43229847d64da8c10e8753bf4f23c8726c4a60ff5db1f14d
font_04_sfnt_off00014e91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14E91 16516 bytes
SHA-256: 14e97cea28ec0eb22acb6ba431931eb0b95133f770c29e9f0173a31f16290075

Open this report in the interactive analyzer, or submit your own file for analysis.