Malicious PDF — malware analysis report

Static analysis result for SHA-256 88b3b3e6f8627d6c…

MALICIOUS

PDF

96.7 KB Created: 2021-03-07 22:47:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: 7ff91e995b10823fb9fac364e206b9d9 SHA-1: 639de739cde46f50c14e106571173784321ee18d SHA-256: 88b3b3e6f8627d6c270b34a790d6c52063214f457578598dcf461ce452f08a20
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of embedded URLs pointing to various domains, suggesting it functions as a link farm. One critical heuristic identified a link to known malicious redirector infrastructure, specifically 'https://dafemum.ru/wix?keyword=el+dios+griego+de+la+guerra', which is a strong indicator of phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9958

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=el+dios+griego+de+la+guerra In PDF document text
    • https://cdn-cms.f-static.net/uploads/4393763/normal_6024adfcb5d85.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4410703/normal_5ff8f9b68622f.pdfIn PDF document text
    • https://cdn.sqhk.co/jurugaguvedu/ou2hjjf/56698416679.pdfIn PDF document text
    • https://cdn.sqhk.co/nedivixozu/gfKK4Er/doofus_drop_mod_apk_1._0._23.pdfIn PDF document text
    • http://instapodarok365.site/vuzakibilivexokc69f.pdfIn PDF document text
    • http://findattime.com/what_is_4g_lte_cellspot0kkw2.pdfIn PDF document text
    • https://cdn.sqhk.co/jukusenefow/gdRjiQX/14962219817.pdfIn PDF document text
    • https://wikagigodoxuf.weebly.com/uploads/1/3/2/8/132814929/vefifu.pdfIn PDF document text
    • https://bamegipizof.weebly.com/uploads/1/3/4/6/134647446/palako.pdfIn PDF document text
    • https://cdn.sqhk.co/gogoturowib/jfiehd3/diaphragm_pain_in_back.pdfIn PDF document text
    • https://cdn.sqhk.co/tajugajobib/ghhiieO/fodowaxegadosemidenig.pdfIn PDF document text
    • https://jexumaravoza.weebly.com/uploads/1/3/4/2/134265375/kejobevejaxero.pdfIn PDF document text
    • https://dudixugodibemuf.weebly.com/uploads/1/3/1/4/131406925/zovolapigolimu.pdfIn PDF document text
    • http://yyyyyyhhhhh.space/tft_item_build_sheety6p7s.pdfIn PDF document text
    • http://openlait.pro/86796842755y5hdh.pdfIn PDF document text
    • https://pulosonimoge.weebly.com/uploads/1/3/0/7/130739093/xurufow.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445532/normal_5ff12a3a52e66.pdfIn PDF document text
    • http://reduslim-europa.site/8078063127988b0x.pdfIn PDF document text
    • https://puxosuloboja.weebly.com/uploads/1/3/4/6/134677226/b432c814d95db70.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393625/normal_600bde84b4abb.pdfIn PDF document text
    • https://cdn.sqhk.co/tiwefuxab/hifVhhc/bingo_rider_free_casino_games_online.pdfIn PDF document text
    • https://cdn.sqhk.co/tibatojo/giiXhfC/gimazonefu.pdfIn PDF document text
    • https://tefajarusi.weebly.com/uploads/1/3/0/7/130775660/76d585e6cc.pdfIn PDF document text
    • https://dajilifu.weebly.com/uploads/1/3/4/8/134891154/5247581.pdfIn PDF document text
    • https://cdn.sqhk.co/gitogozune/i8Ricij/ice_crush_2019_level_510.pdfIn PDF document text
    • https://gunobapeve.weebly.com/uploads/1/3/4/7/134706327/fesumixixovef.pdfIn PDF document text
    • https://gapojusegora.weebly.com/uploads/1/3/1/4/131408170/6484939.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000132d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x132D8 4952 bytes
SHA-256: 8bbf8bfddf209dd3d933c60418320a649d129b5592bf514b586453034bf34c1b
font_01_sfnt_off000143ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143BA 15512 bytes
SHA-256: 27c438c5b24e9bcda43b989b64c4c22035e066729f22d87f9ea3dbb195a1f44c

Open this report in the interactive analyzer, or submit your own file for analysis.