Malicious PDF — malware analysis report

Static analysis result for SHA-256 85dad0540b000cec…

MALICIOUS

PDF

78.8 KB Created: 2021-04-26 20:23:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: e4aa7c082f4c54c1a4008e8a2e6281f1 SHA-1: 6ad89471571b331a55d19539f7d760d9534d7f8d SHA-256: 85dad0540b000cec6cc169a8ad5d8c442c7a69f88c22b7e6645dfcdbf6ea3acc
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to suspicious or disposable domains, indicating a link farm or SEO spamming operation. One critical heuristic identified a link to known malicious redirector infrastructure. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=whirlpool+duet+washer+f2+error+code In PDF document text
    • https://cdn-cms.f-static.net/uploads/4408875/normal_60598f1f119cc.pdfIn PDF document text
    • http://ravigimojamel.mypressonline.com/can_you_make_money_with_algorithmic_trading.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477369/normal_606107386ead2.pdfIn PDF document text
    • http://vobalemujumojak.mywebcommunity.org/14828910118.pdfIn PDF document text
    • http://pijojavoto.mygamesonline.org/76592856838.pdfIn PDF document text
    • http://vazagitomis.mypressonline.com/99101467408.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379233/normal_606c3440d4161.pdfIn PDF document text
    • http://jebifawulu.mywebcommunity.org/59848693867.pdfIn PDF document text
    • http://mateguwokalidub.getenjoyment.net/65626791328.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485163/normal_60403a3c58163.pdfIn PDF document text
    • http://liberum.sportsontheweb.net/parasitic_castration.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_c788bbba9d024bfe884bf5da5429ca1c.pdf?index=trueIn PDF document text
    • https://84bd2c60-91d0-47b6-9565-6ae8a6593e58.filesusr.com/ugd/963627_d87de189d25049d98f8d9b300d079f67.pdf?index=trueIn PDF document text
    • https://92fed17e-af34-466b-b3fe-38cd9ef27699.filesusr.com/ugd/192d58_c6770eb24930439c8386778f173fd85b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nevowimo/1352586585.pdfIn PDF document text
    • https://0f06aff0-b517-40b5-9866-10b5337f6c6a.filesusr.com/ugd/cac9e4_d324274f8e07488f9623d297d867ca2a.pdf?index=trueIn PDF document text
    • https://77bc4ea4-de20-41c0-a463-a5315db628d9.filesusr.com/ugd/2c69e3_9419454917994085b61b834fcdd5990f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/senodiw/11149070957.pdfIn PDF document text
    • http://zukomakiduw.myartsonline.com/dugasedabafufosuxu.pdfIn PDF document text
    • https://a0758896-f8c2-4fc9-8c7e-5c1738e8bc18.filesusr.com/ugd/0ce882_638f2079fb93444c9b6ece0c91cd6d06.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fusopoxipo/civil_engineering_drawing_books_free.pdfIn PDF document text
    • https://s3.amazonaws.com/tiduro/play_store_pro_google_drive.pdfIn PDF document text
    • http://kivozusemu.atwebpages.com/88628452748.pdfIn PDF document text
    • https://4be8a7ba-6c9a-47a4-99fc-a5961b41a404.filesusr.com/ugd/132250_a8c88943c72f4291ad1b63b998db641b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pegebunov/19116311875.pdfIn PDF document text
    • https://1c54689f-8f60-44d8-8d81-b144d6ea8ada.filesusr.com/ugd/787b0a_0e24388607ff43b2a2ae009a02045cda.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5DE 5480 bytes
SHA-256: 401d963d8636dd9914c8649c9a11112d102951209efadad5d166855614709559
font_01_sfnt_off00010895.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10895 10836 bytes
SHA-256: 7bc0db89eaa2d9530c4cc66f8a05fd9a30f07575f00d0641d6b585cb16a206c5

Open this report in the interactive analyzer, or submit your own file for analysis.