Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e80ba6df8d569ed…

MALICIOUS

PDF

76.2 KB Created: 2021-04-02 16:55:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 7b778e8e030f7b45bd9b7186401f58cb SHA-1: 571973cd29a8bbac389c694f61c857d565438d9a SHA-256: 8e80ba6df8d569ed9e6b3356380aff0d7bd15821c0a0cd387c28816c09d9bab7
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document exhibits characteristics of a link farm or SEO spam campaign, containing a large number of external links pointing to various websites, some of which are hosted on disposable infrastructure. One critical heuristic identified a link to known malicious redirector infrastructure, and another flagged it as a PDF SEO link farm. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the sheer volume of links and the presence of a malicious redirector suggest an attempt to lure users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=nintendo+wii+console+buy In PDF document text
    • https://rujemezemomiwo.weebly.com/uploads/1/3/0/9/130969750/3608837.pdfIn PDF document text
    • http://kadabafomelu.66ghz.com/683852185.pdfIn PDF document text
    • https://bamususifilozok.weebly.com/uploads/1/3/1/3/131383301/dedelalafesire.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485935/normal_60387bc90f9a8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477629/normal_605c3f2d430c6.pdfIn PDF document text
    • http://autobuff.xyz/sevojuzuvodoxoixffn.pdfIn PDF document text
    • http://chatik85939775.fun/486015499162yq7q.pdfIn PDF document text
    • https://vurerabekude.weebly.com/uploads/1/3/4/4/134493837/6061128.pdfIn PDF document text
    • http://rojenugilin.22web.org/tiwarixaxulik.pdfIn PDF document text
    • https://kazajiti.weebly.com/uploads/1/3/4/4/134456981/21b15673c60.pdfIn PDF document text
    • https://berebexamoleti.weebly.com/uploads/1/3/1/3/131384136/7502d23ee8e531f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382643/normal_6001093731ea1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://jufosuliz.epizy.com/bully_dog_fight_video.pdfIn PDF document text
    • https://235a1a37-2bc9-4d3b-8f1d-d3952ad9fba8.filesusr.com/ugd/3111f7_4b840b2a873e43caa921891e90a46de8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a5a9d26-3019-4838-b1ab-f4a39e2e95a3/gusaminixodudakosozezed.pdfIn PDF document text
    • http://vemewef.rf.gd/top_books_for_success.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b30c5e10-4de9-4723-ab87-100a64435307/98680544596.pdfIn PDF document text
    • https://37e0f79d-b0c1-4727-b76d-5b759c81288f.filesusr.com/ugd/9c66ff_ca176ddaa2494007a5060aae5fd90ad2.pdf?index=trueIn PDF document text
    • https://0b21792c-a699-4cf4-8833-5910c6ad58af.filesusr.com/ugd/b0b521_ac83d87a4c9e4bb387b48a0ddf558ee8.pdf?index=trueIn PDF document text
    • https://79e5ec13-148a-49e7-9308-7b7844992bd9.filesusr.com/ugd/1d149b_5394fb09ddaf4bb1a2cd56185d58fd45.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/075cc197-11e2-4b69-a57f-af8610f6474d/41297490914.pdfIn PDF document text
    • http://toxuvuzi.epizy.com/levopuwufokemarekapadafo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc98.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC98 4812 bytes
SHA-256: c7b2d869aed56a4754ad00fd14087df2fe16568dc676728b2fa6a128f4a89adb
font_01_sfnt_off0000dd20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD20 10104 bytes
SHA-256: 1d3453bbff06fde77a6c3fb2395e790d360ce95a69aaaa74e699faeae0fc5f0f
font_02_sfnt_off0000ffe7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFE7 16204 bytes
SHA-256: e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15
font_03_sfnt_off00011515.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11515 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.