Malicious PDF — malware analysis report

Static analysis result for SHA-256 972ca2479790205f…

MALICIOUS

PDF

72.0 KB Created: 2021-04-03 18:58:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bd40814db70be39810e9cafb92486bd7 SHA-1: dde9343146f25d7ff2920c680b8b14f00b72e1f3 SHA-256: 972ca2479790205f4c1fafa5c53d27aa5ce6cebd5a1060c1ac03b48c4899a1f3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. One of the external URIs, 'https://seumenha.ru/strik?utm_term=huebsch+washer+cost', is flagged as suspicious. ClamAV also detected the file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0', indicating a phishing or trojanized PDF. The document body is heavily obfuscated, preventing a clear understanding of its direct lure, but the link farm heuristic strongly suggests a malicious intent related to SEO manipulation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=huebsch+washer+cost
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0a55ad25-9bcc-4d48-a8c5-4d8720f1957d/how_many_naia_division_2_schools_are_there.pdf
    • https://s3.amazonaws.com/sezebepit/neurokinetic_therapy_book_free.pdf
    • https://uploads.strikinglycdn.com/files/16e258de-9f2e-4e8b-8020-aea7a5600299/zebco_202_fishing_pole.pdf
    • https://e18e6c05-101e-4f41-9c4d-f518aea09dbb.filesusr.com/ugd/7972b3_9adc161e74ad43ddb2492c92d2d817ef.pdf?index=true
    • https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_4e4d9ac9a9ca42cfbc482e2be7d689cb.pdf?index=true
    • https://6d0c6d30-55b9-4b7f-8145-34d11b484ddf.filesusr.com/ugd/8db56d_f475aff7d732407faf5653fa2f20b50a.pdf?index=true
    • https://31f314b5-0768-4c24-bd49-4596ea953b46.filesusr.com/ugd/85a4b1_e8b7c356c70c457ea8350645b3ea39de.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c38e52e7-be1b-4b68-adac-392e38d73bec/quadrilaterals_and_coordinate_geometry_worksheet_answers.pdf
    • https://s3.amazonaws.com/sejakopa/brochures_templates_free_s_word.pdf
    • https://313cea95-bd78-4864-9d9d-3b26c3bbe0bd.filesusr.com/ugd/2142af_35ef9477654c4a60b9aa3ea689127821.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2b1e45ff-03cb-4f7f-b90c-95dcc97dbe00/13900775356.pdf
    • https://uploads.strikinglycdn.com/files/7e1da58c-68c0-413a-91cc-a658e5d54024/96974373125.pdf
    • https://be5a03d2-cb36-429a-bb4d-4773f067dd3b.filesusr.com/ugd/b46ca8_20acaa027de84575951f9fa4852dae71.pdf?index=true
    • https://ac263381-fdad-4fda-ae78-6df6d71032d6.filesusr.com/ugd/25c42e_f01b1545f4914b2cb61efcc956bfa3f6.pdf?index=true
    • https://8271b8e8-1520-4b18-8785-2fafc8cd33e6.filesusr.com/ugd/efc97f_407356c9a2c74b3085c9bfb3f4da88ff.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0a62ab9d-ebf7-4b21-9d29-66819ccf3826/is_yo-yo_dieting_safe.pdf
    • https://855e1e5b-0daf-4dce-aa73-dfad2bfec5df.filesusr.com/ugd/ced2dc_77af6f365be1460982639b8702483069.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f4202103-d51a-488b-990a-454a3d80a650/is_the_maze_runner_on_hulu.pdf
    • https://uploads.strikinglycdn.com/files/b0f94b1b-b944-4ded-aa94-dc4f7f2a36e5/m-audio_keystation_49_mk3_49-key_midi_keyboard_controller__software.pdf
    • https://a22c3535-4c29-4f26-bf6b-1e631d3648e5.filesusr.com/ugd/28986c_38106cad4efc4c8f9701cdf7fcb866ec.pdf?index=true
    • https://2cc12256-1025-444a-bacb-901a9f007bda.filesusr.com/ugd/d1fcfc_50c6e331e8fa47a7900913f48e06c5eb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da3e.bin
acdf30f3cdebfd440250581d9ba3c99f94eaf63e17124b4c1cfe1654202c06da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA3E 5048 bytes
font_01_sfnt_off0000eb73.bin
1b582e0d1aee054fb046ef71b53367b7eaf113ce3aa98bbbeaaa3b029dff4592		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB73 11652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.