Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c38d4f1e918b41c…

MALICIOUS

PDF

80.2 KB Created: 2021-03-20 00:15:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b90cffb13e59b40eefef8789f07bd724 SHA-1: ea034b2e2ca0dde08f84c3e6700952e9b9249277 SHA-256: 9c38d4f1e918b41ca93702d17f2a85894a5aa7d5fb0738c04ce92d8b29cb0350
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm designed to redirect users. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution. The presence of external URIs and a link farm points towards an attempt to exploit users by directing them to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=destiny+2+bad+juju+catalyst+guide
    • https://lekemevegov.weebly.com/uploads/1/3/1/4/131410090/vokikuwinezew.pdf
    • http://ritegifufefut.scienceontheweb.net/danoduwovegepunoxixarog.pdf
    • http://wasegulom.mygamesonline.org/48408100256.pdf
    • http://xifutipixa.mywebcommunity.org/didunisaviloxuwizisegov.pdf
    • http://jovefupe.mywebcommunity.org/94703827412.pdf
    • http://daxavepevepa.mypressonline.com/tosigob.pdf
    • https://ponutafozo.weebly.com/uploads/1/3/4/7/134705240/2478370.pdf
    • http://rosutob.getenjoyment.net/what_is_molecular_and_cellular_biology.pdf
    • http://xujaxul.mywebcommunity.org/best_markup_app_mac.pdf
    • http://vobalemujumojak.mywebcommunity.org/functionalism_media_theory.pdf
    • http://wimebenese.getenjoyment.net/diguzodor.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://13dbc848-c95e-4197-a439-3ae2050b6ee2.filesusr.com/ugd/46bbe5_8cfd50af271b44f0a8ae6c4ba615dff2.pdf?index=true
    • https://s3.amazonaws.com/mogipegi/82989361615.pdf
    • https://s3.amazonaws.com/lolaritemukole/32347724963.pdf
    • https://uploads.strikinglycdn.com/files/2fa5b688-d305-471b-ba09-1a422517fc69/20769297332.pdf
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_6b193548434d4bc7988e58f5a04e6d5d.pdf?index=true
    • https://47e4df30-8702-49a4-8bd5-327e1546ff06.filesusr.com/ugd/379272_28dd625a741244c881ffe83d966f417c.pdf?index=true
    • https://fb1cd387-549b-40f1-a5a4-67fd65d29bb3.filesusr.com/ugd/4200b4_aa08090db2ad44cb8ca24c834a7d349b.pdf?index=true
    • https://0491f86b-060d-4f4a-be23-b0d01488777f.filesusr.com/ugd/faa7ef_11943544c1254fd7bd04d71cd1c918b4.pdf?index=true
    • https://s3.amazonaws.com/zifilobesumafi/free_printable_wedding_mad_libs_template.pdf
    • https://uploads.strikinglycdn.com/files/81d6a770-a0f0-4d4d-ac43-dcb8df265b05/como_ser_un_buen_lider.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee96.bin
42016c390f1e473057fff27eb08b3f4c732ea793716bece341e82e0b2104ad12		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE96 5232 bytes
font_01_sfnt_off00010078.bin
438031fd6901f7bfbf07067188ecb59f508c7b33ce16ecfc69f2aa34bec72210		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10078 10800 bytes
font_02_sfnt_off00012561.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12561 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.