Malicious PDF — malware analysis report

Static analysis result for SHA-256 820919ed03ba2777…

MALICIOUS

PDF

90.2 KB Created: 2021-05-11 19:30:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: b010863fed6360446c5928819240ba5a SHA-1: 24c08de822b736fffc384ee52042a2f64c9d46e3 SHA-256: 820919ed03ba2777ee907729ca6352217c7ce18c791e9ee0fc4ee0aac9c6d4ed
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, containing numerous external links, with one prominent URL pointing to a suspicious domain. The presence of embedded URLs and the overall structure suggest it's designed to redirect users to potentially harmful content, possibly as part of a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=2019+tesla+model+3+mid+range+price PDF link annotation
    • https://cdn.sqhk.co/leperanurosi/iji0yhd/gorafez.pdfIn PDF document text
    • https://megularebenava.weebly.com/uploads/1/3/1/1/131164421/6581851.pdfIn PDF document text
    • https://bekogome.weebly.com/uploads/1/3/1/4/131454098/8163807.pdfIn PDF document text
    • https://cdn.sqhk.co/dorejewibiz/ghghehf/gladiator_glory_gameplay.pdfIn PDF document text
    • https://zedetebi.weebly.com/uploads/1/3/1/0/131070456/roviwanox.pdfIn PDF document text
    • https://vuxulirupam.weebly.com/uploads/1/3/5/3/135346280/3466616.pdfIn PDF document text
    • https://kabijibijeg.weebly.com/uploads/1/3/4/9/134900291/d825ec7ef1fc.pdfIn PDF document text
    • https://cdn.sqhk.co/temududote/jejf3yC/mutant_genetic_gladiators_breeding_guide_wiki.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2eb6c9b2-2754-46a9-b625-68a43bda4e15/how_do_i_connect_bluetooth_to_my_bose_wave_radio.pdfIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/apartment_guidelines_victoria.pdfIn PDF document text
    • https://ce099f17-eb12-430b-a452-8d789b3ee5a8.filesusr.com/ugd/aef5b7_c304f23e0b284ee89dac24ea887b8203.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/13b89678-cbfc-4321-917c-f614a1afab4d/nuwijiwadojiwubilunajom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d013fa68-e59e-4f89-b085-412a17c5fe0d/manual_for_power_pressure_cooker_xl.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6616597f-898c-4c63-8d0a-3279402469ad/64250986991.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aab94064-9286-4b2c-9d9d-75475ddb6788/4174739540.pdfIn PDF document text
    • https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_e3859e1335f8423c97c6849965ceff2d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/libusamagowuvo/baziwasalu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9bb7c182-62fa-4664-8213-51602a7d0dff/bebumekerejejaladowob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7e4def0-7b2c-456b-bead-eb17e16931fe/28953468006.pdfIn PDF document text
    • https://s3.amazonaws.com/zamemigojat/billing_rate_inkindo_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/330ead59-60d1-48b5-ac23-c5bbe54da412/wesed.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf76a347-5538-4355-bca8-d133c08de928/10467526922.pdfIn PDF document text
    • https://s3.amazonaws.com/xoferuzu/bloodshot_ramparts_challenges_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/vuxagixil/how_to_listing_products_on_amazon.pdfIn PDF document text
    • https://161abad2-7de2-49bb-9904-d6e2a620a662.filesusr.com/ugd/2eec94_d3b0236cc1ba42f2aed4f80823ef333c.pdf?index=trueIn PDF document text
    • https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_ccdb9225dd6f4e5f8bcc4f670c4c0dc9.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011e8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E8A 5944 bytes
SHA-256: 3fa7611008ac988b729c5330f1dbf21ba5bc125cdae8511a48e757f508c0b3c0
font_01_sfnt_off000132a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x132A6 11320 bytes
SHA-256: e890bd295aff207b9eb56b768c939b7ea6e6d9358c977aef33e834f0edbcddae

Open this report in the interactive analyzer, or submit your own file for analysis.