Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b8caa862d12ff29…

MALICIOUS

PDF

84.9 KB Created: 2021-03-23 19:40:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: f35b885582f23f6cd44484d338a7b0d8 SHA-1: db4288b1b28b78c2e5b0ed64af130c1d6b4cacda SHA-256: 8b8caa862d12ff29003085afbef97934b1ebd355483eebc393497a4bf1a29a86
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains embedded links that redirect to a suspicious domain, identified as a phishing lure. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, many of which are likely malicious. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to deliver a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/aws?utm_term=scout+sniper+training+for+civilians PDF link annotation
    • https://ponuwusareti.weebly.com/uploads/1/3/1/6/131636782/5019282.pdfIn PDF document text
    • https://liwufodabex.weebly.com/uploads/1/3/4/8/134872973/xisewiw.pdfIn PDF document text
    • https://vasinurevesodux.weebly.com/uploads/1/3/4/6/134605286/7520812.pdfIn PDF document text
    • https://fenazimo.weebly.com/uploads/1/3/4/4/134437137/debiteze.pdfIn PDF document text
    • http://kevebofuru.medianewsonline.com/450_word_school_spelling_bee_study_list_2020.pdfIn PDF document text
    • http://kopalirigel.mypressonline.com/attestation_de_prsence_employeur.pdfIn PDF document text
    • http://jarizodej.22web.org/28963310915.pdfIn PDF document text
    • http://famafivas.iblogger.org/rusesosunowavuf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lowebemuwojiso/47456357362.pdfIn PDF document text
    • https://6bc553e5-d0de-4278-827a-c77c8eb32fbd.filesusr.com/ugd/4a6c57_163fe4f885234551b084af52af2d6d5a.pdf?index=trueIn PDF document text
    • https://9abff256-b119-4e75-a612-dfc075f5428e.filesusr.com/ugd/c73517_84f32129d2914149b021ba3e803e9ea3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wewiro/bebas_new_font_free.pdfIn PDF document text
    • http://fofeparulofiz.rf.gd/3901018409.pdfIn PDF document text
    • https://d497f082-4895-42de-a72c-038d9367c8a3.filesusr.com/ugd/8e727b_5de400833e2f4604835f8c5ac77e8cef.pdf?index=trueIn PDF document text
    • https://3064a0a7-8496-4b95-be1e-56094aee372f.filesusr.com/ugd/0cf4b9_870d8b152fcf4899b3d82e8bceabb26f.pdf?index=trueIn PDF document text
    • https://113c517c-d7b0-4b36-99d7-6722bcb7ef36.filesusr.com/ugd/8e66a5_e37ced8483d94e65bfbdb8b840d1d1d1.pdf?index=trueIn PDF document text
    • https://26c1613e-5d28-4fa3-89cb-3d2c9ab59faf.filesusr.com/ugd/fe83c3_f442a6662b2f45a6b76d0faf2dfc7a1a.pdf?index=trueIn PDF document text
    • https://70010cfe-69b1-4fe9-a336-bdfe2418dc1e.filesusr.com/ugd/f1d680_0df09693b5f04fec91de47c969dfecf5.pdf?index=trueIn PDF document text
    • https://bad3f395-1638-4667-b349-d6f934eeab49.filesusr.com/ugd/ed2d23_b23a3faeb019427aa34119fdccce9f92.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xufujofaleki/52239981546.pdfIn PDF document text
    • http://rogofideb.onlinewebshop.net/75221196073.pdfIn PDF document text
    • https://s3.amazonaws.com/povodijirig/maze_runner_is_there_a_4th_movie.pdfIn PDF document text
    • https://s3.amazonaws.com/remuv/algoritmo_cubo_rubik_4x4x4.pdfIn PDF document text
    • https://178fd8f3-986e-459b-a431-83c1f58eadb8.filesusr.com/ugd/7a8e82_6f33906431d24f9ea6e6b9a1ee9af159.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C5E 5344 bytes
SHA-256: cbbb54faa61b78e22e792f8bebdcb6f2ccd1ac8ab8507a6cd0e24b3a4e52db08
font_01_sfnt_off00011eaa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EAA 11588 bytes
SHA-256: 8716b8cd785a510f2b0e59936582d74609b9cb68a9a634635cb70d9a572b4b34

Open this report in the interactive analyzer, or submit your own file for analysis.