Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bc23a20a2690424…

MALICIOUS

PDF

80.3 KB Created: 2021-03-24 00:05:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 1a0755cedaf9d27dac807a42f58c9e75 SHA-1: bd29f09f18191f2f9f91d9ee5892a435d1e0834f SHA-256: 7bc23a20a26904248178c2e947219f72bc56a8d21afbc3a988e8550d1c362270
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, directing users to numerous external URLs, including one that appears to be a search query for 'naruto posters framed'. The presence of many external links and the use of disposable hosting suggest a tactic to manipulate search engine results or redirect users to potentially harmful content. No scripts were extracted, but the overall structure points to a phishing or SEO spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=naruto+posters+framed PDF link annotation
    • https://xowitato.weebly.com/uploads/1/3/0/7/130776358/3102259.pdfIn PDF document text
    • https://fegajasun.weebly.com/uploads/1/3/4/5/134502742/timevo-ligibopilifufo.pdfIn PDF document text
    • https://fogojokiverowur.weebly.com/uploads/1/3/0/9/130969702/9972920.pdfIn PDF document text
    • https://cdn.sqhk.co/rojisixel/ibGjgif/dhhs_victoria_annual_report.pdfIn PDF document text
    • https://vonorakukipi.weebly.com/uploads/1/3/4/7/134721252/fcdbe486b00349.pdfIn PDF document text
    • https://cdn.sqhk.co/xuxiropuwomo/djhb2je/jazepumol.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://e0d0d77b-4c00-4265-bc22-f0cc5cf11ada.filesusr.com/ugd/957eb4_7aee03d27d0c43518915db67da5222f2.pdf?index=trueIn PDF document text
    • https://19508648-7f28-415f-8121-b57715dc1465.filesusr.com/ugd/9734e7_71abf65e1cab4e049f5382bf4dbcb533.pdf?index=trueIn PDF document text
    • https://4dcfe184-cd6c-48f8-9f23-5461c743a1d4.filesusr.com/ugd/cc8533_fe345520f5534d118cb9b3e137eb2879.pdf?index=trueIn PDF document text
    • https://63d876aa-455f-4c41-9c38-50747f3e0b95.filesusr.com/ugd/a220d5_d43ffb559ee447b3827c98a7253abcdf.pdf?index=trueIn PDF document text
    • https://d670dda7-df53-4ef1-8eda-d3256df28744.filesusr.com/ugd/dbbbec_0de06848c14445458fe9d4333fee774f.pdf?index=trueIn PDF document text
    • https://fecd0c08-032d-4b8b-b26c-6108aca7a00f.filesusr.com/ugd/a87c8b_9f9538bf2eb344ccab2dff8e47b47ae8.pdf?index=trueIn PDF document text
    • https://1c437d0a-cccb-4a8a-93f1-39e0b5126915.filesusr.com/ugd/b91566_2c98212c673040ed8691deded96ef1c3.pdf?index=trueIn PDF document text
    • https://a39ac558-8fe8-437d-9e10-dc9402d6cb9c.filesusr.com/ugd/1ebe14_6f2d30b90920440790e1036102e738b9.pdf?index=trueIn PDF document text
    • https://521a9f5b-5c7e-4f25-a9e4-5446fb1b1975.filesusr.com/ugd/c1a494_274dadfdb82741a1a7919ec7da5a8bea.pdf?index=trueIn PDF document text
    • https://aee666f7-65d2-4416-8089-42e5bd85255d.filesusr.com/ugd/c4036c_393a8d0086ac4c91b3ed9a50c4a00821.pdf?index=trueIn PDF document text
    • https://38aad9b5-7a72-45b8-ac81-9fe73ce82000.filesusr.com/ugd/08338c_b678d9a0f88245b791c9ab8759b9a840.pdf?index=trueIn PDF document text
    • https://044ec7df-721b-4788-b209-87474a3fcb06.filesusr.com/ugd/60ffa2_3654e75ca402405da62e7485485d8add.pdf?index=trueIn PDF document text
    • https://ab0007c4-58ca-4db2-ab23-686bae4d53c1.filesusr.com/ugd/8bf248_4a5ff9f2333c4e109f742729056450f6.pdf?index=trueIn PDF document text
    • https://0ea28b16-58c2-472d-b6be-3e97fe9b7bb6.filesusr.com/ugd/696b8a_d7a686d593f54a04847dc85123b00c3a.pdf?index=trueIn PDF document text
    • https://6440a9f6-5e82-4153-977b-4ffe9374ec4a.filesusr.com/ugd/7182f3_6104a5d467c64466aa11ea7c69fc2fb5.pdf?index=trueIn PDF document text
    • https://5d3a3edc-1384-4eb0-a354-174dd54c13aa.filesusr.com/ugd/7f5dc5_84d8628533e740eea970e68f06b5d990.pdf?index=trueIn PDF document text
    • https://6afed14e-2b01-442b-8c2e-11a8a6f39965.filesusr.com/ugd/46a5ae_5e14a910496448ad96e0025178e46e18.pdf?index=trueIn PDF document text
    • https://621cd70f-1aca-46de-91df-1bd8162c3e90.filesusr.com/ugd/9f1ad6_285c8af4a8424bfca2861f66837dc537.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010005.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10005 5124 bytes
SHA-256: 8454df4287874db5a87bb169b7e5b2e21a050c2b9fee85b46a7a6be90c01ff68
font_01_sfnt_off0001115f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1115F 10124 bytes
SHA-256: c55319ed5dcc67f16aa3f5e7dc0e81ee49aa833ad27eb417cc28f77f8e0d8aa4

Open this report in the interactive analyzer, or submit your own file for analysis.