Malicious PDF — malware analysis report

Static analysis result for SHA-256 8193f8deb91dd4ee…

MALICIOUS

PDF

64.0 KB Created: 2021-03-09 20:49:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 06ba5a5d562ca3bc30a5e4b873ec984d SHA-1: 5ca0dec35dde6d3ef480cb151b39c7200b0f7256 SHA-256: 8193f8deb91dd4ee4e090d6cd4f17fa267c8ed83814260e54dba88041712bd70
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm designed to redirect users. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution. The presence of external URIs and a link farm points towards an attempt to exploit users by directing them to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9263

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=axe+alliance+x+empire+apkpure
    • https://gibiboxovozigux.weebly.com/uploads/1/3/4/7/134722082/36fe8148267b.pdf
    • https://tixonanixob.weebly.com/uploads/1/3/4/8/134890866/pamebijogosa.pdf
    • https://cdn.sqhk.co/kosifodalab/gfvgcFl/flip_water_bottle_challenge_fortnite.pdf
    • https://cdn-cms.f-static.net/uploads/4468537/normal_6021618c1cbca.pdf
    • https://cdn.sqhk.co/busumodofu/iiTIPie/mammoth_tracks_ice_age_trailer.pdf
    • https://gixujadimi.weebly.com/uploads/1/3/4/7/134708567/b6228ac.pdf
    • https://cdn.sqhk.co/xokebuzizo/gjfMglp/my_first_words_flash_cards_dk.pdf
    • https://cdn.sqhk.co/xetilibul/hPFtxia/fukibul.pdf
    • https://static.s123-cdn-static.com/uploads/4425230/normal_5fcc6d9c887ba.pdf
    • https://lukimozogu.weebly.com/uploads/1/3/4/6/134638062/12d44.pdf
    • https://wewiloviwa.weebly.com/uploads/1/3/4/5/134585183/budum-losulekipu-segemigatininun-sabegifowet.pdf
    • https://static.s123-cdn-static.com/uploads/4454424/normal_5fed421c9714b.pdf
    • https://cdn.sqhk.co/xusovatovu/TigugdE/hello_neighbor_game_review.pdf
    • https://kumobavubisu.weebly.com/uploads/1/3/0/7/130775432/bepasavamike.pdf
    • https://wufisosudima.weebly.com/uploads/1/3/0/8/130874090/dikokimafezipezetor.pdf
    • https://vipelunova.weebly.com/uploads/1/3/2/7/132712034/1b086dc.pdf
    • https://sixutaxujarupi.weebly.com/uploads/1/3/4/8/134882582/799704d9.pdf
    • https://rixorololexapi.weebly.com/uploads/1/3/1/8/131857390/legovop_fasebazof.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6cbe2f5c-748b-4bc6-b691-25a968a47885.filesusr.com/ugd/d6b5da_5a8b357acfd24443be2bd05d4be910b1.pdf?index=true
    • https://s3.amazonaws.com/tuzamada/gaming_monitor_buying_guide_reddit.pdf
    • https://ecf8b3bd-8201-449f-a39c-156acd88681e.filesusr.com/ugd/97634b_3439900edb6440ac86f2113411446192.pdf?index=true
    • https://s3.amazonaws.com/kumasala/61728160195.pdf
    • https://911f1565-2faa-4874-b261-330d521e7362.filesusr.com/ugd/f46427_1ce0fb9734a24bdf8e8f39b66cebc648.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eacb.bin
9a844d53f66dd90cc2c1d43b132de78532baef12c2fa0a88de5b569f380f2fe6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEACB 5024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.