Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c357c1ca392509d…

MALICIOUS

PDF

92.6 KB Created: 2021-06-05 23:02:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 608fcf68b657bd713096435b557a714f SHA-1: 3f7cff37bcd7855a30ee5909ba9280854e0d1580 SHA-256: 9c357c1ca392509d5a1165763786f27e83d0edd4f49716b397e7d12c3a0ddb9b
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many hosted on disposable domains, suggesting it functions as a link farm or SEO spam document. The presence of URLs like 'https://pistant.ru/pbw?utm_term=noclip+script+roblox+pastebin' indicates a potential lure for users interested in specific online content, possibly leading to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/pbw?utm_term=noclip+script+roblox+pastebin PDF link annotation
    • https://jogelobob.weebly.com/uploads/1/3/5/9/135961552/f442a753.pdfIn PDF document text
    • https://koxawikala.weebly.com/uploads/1/3/4/6/134643159/tewafe-pupinumiw-zirup.pdfIn PDF document text
    • https://tewoxole.weebly.com/uploads/1/3/2/6/132695213/86752f11ccfa9a.pdfIn PDF document text
    • https://vipeketiduwe.weebly.com/uploads/1/3/1/6/131636725/bc80695cac795c7.pdfIn PDF document text
    • https://bimelubisazabe.weebly.com/uploads/1/3/4/4/134492892/3007194.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://sisagexal.pbworks.com/f/linosiroboso.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60db2db2-5fda-40b7-b023-7e133be5b610/do_you_pay_taxes_on_trs_retirement.pdfIn PDF document text
    • http://wojoxevom.pbworks.com/f/productos_notables_formulas-trinomio_al_cubo.pdfIn PDF document text
    • http://lomubel.pbworks.com/w/file/fetch/144561714/programao_em_ladder_exercicios_resolvidos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/354f2c90-8992-4d91-b16c-195ce79be537/why_is_my_hp_officejet_5255_not_printing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e0cc05b-fe8d-4e30-b2a2-0a2f254957d2/31541210741.pdfIn PDF document text
    • http://tusoxefum.pbworks.com/f/40902960569.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5fe053eb-1238-4d50-a7bc-f8d5db59aa91/xexunonewusek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0106dec2-2584-41fa-b8ca-9d2f64eb1a4b/83670918813.pdfIn PDF document text
    • http://mukonisu.pbworks.com/w/file/fetch/144454656/89983427973.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f95cfe8c-2934-4175-8c0d-f7e19e5704d8/21004295066.pdfIn PDF document text
    • http://kizisoj.pbworks.com/f/daemon_tools_lite_10.13_serial_number.pdfIn PDF document text
    • http://wigonewakil.pbworks.com/f/cuantos_cm_es_1_metro_cuadrado.pdfIn PDF document text
    • http://gipomebepate.pbworks.com/f/nojidejexogosuxax.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e985.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE985 3748 bytes
SHA-256: 5b2ad63977f2f7704367593362d94e11db5147b6d20acf45cc9ae1f7f1f29f7c
font_01_sfnt_off0000f6bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6BF 5104 bytes
SHA-256: 011be63ccae443c63debe4bc2d3d3e62b4fa1208271d0a10d404cf60e02bea76
font_02_sfnt_off00010823.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10823 6216 bytes
SHA-256: 8bda426840c768791926c00b30342f29149c5df2c3f8ae0096716228bf007f49
font_03_sfnt_off00011850.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11850 17012 bytes
SHA-256: bf4251a2c263eb6815b7d8fdafb4a02e2375baf243d2492c45fe61c0e666a285
font_04_sfnt_off00014c12.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14C12 16352 bytes
SHA-256: a01dbad3977167dd552bac33222925a8986e255cdf8c81fc79ededa7398c62df

Open this report in the interactive analyzer, or submit your own file for analysis.