Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c5482a01ac00e2e…

MALICIOUS

PDF

90.6 KB Created: 2021-04-02 01:08:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d0ad3b15813096c1e19d876acb925cee SHA-1: 7721c598937ed127df8827c45fffddbf39a81595 SHA-256: 9c5482a01ac00e2ecd36efc8cc5484809e7aef1cb8d4a7236b47067a4eecf151
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating it is a phishing or trojan delivery mechanism. The document contains numerous embedded URLs, many pointing to disposable hosting and employing UTM parameters, suggesting a link farm designed to redirect users to malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically highlights this behavior, indicating the PDF's primary function is to host a large number of links on potentially untrustworthy domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=admission+form+of+sainik+school+rewa
    • https://static.s123-cdn-static.com/uploads/4485942/normal_6005869947ae9.pdf
    • https://cdn-cms.f-static.net/uploads/4468289/normal_601ab85599b4c.pdf
    • https://cdn-cms.f-static.net/uploads/4454982/normal_603a05be8822b.pdf
    • http://jewofuvivonog.getenjoyment.net/electronics_and_communication_engineering_interview_questions_and_answers.pdf
    • http://lalevuw.mypressonline.com/xixulasanasudubu.pdf
    • https://static.s123-cdn-static.com/uploads/4449602/normal_5fff6adc56796.pdf
    • http://fajutixosisi.22web.org/ablutions_patrick_dewitt.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://vawirir.atwebpages.com/common_countable_and_uncountable_nouns_list.pdf
    • http://wisexek.epizy.com/24511516128.pdf
    • http://ferodibev.onlinewebshop.net/argan_el_arte_moderno.pdf
    • http://luzegatujil.epizy.com/nofupin.pdf
    • http://rodiwube.epizy.com/lagu_another_you_brian_mcknight.pdf
    • https://uploads.strikinglycdn.com/files/a09ccbff-b2ab-42ec-91eb-fc004d7281bf/kung_fu_panda_3_cast_espaol.pdf
    • https://2ffa788b-df2f-461f-b9c5-573bec542745.filesusr.com/ugd/374ce0_e006d516741d4ddd9532a97b1ebc301a.pdf?index=true
    • https://22fea36a-5e19-4af1-b4aa-fe6e1efe0ee9.filesusr.com/ugd/b5a188_e24bc5b0310e432ab48d1b208ec41f60.pdf?index=true
    • http://mevomum.epizy.com/nagi_no_asukara_aqua_terrarium.pdf
    • http://taxisariwoboduz.epizy.com/37880078736.pdf
    • https://b00f38ea-0d13-4519-ab0f-1253f0d03ca0.filesusr.com/ugd/289c5e_58a31d332d5f4a059562b6144acef940.pdf?index=true
    • http://ruwopepifip.rf.gd/the_hidden_language_of_computer_hardware_and_software_download.pdf
    • https://uploads.strikinglycdn.com/files/9b0346b4-3744-4fd7-889e-b4d381a465fb/11591088049.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010228.bin
a26fb7138553dbbf53584e7350e7b3d865c04e813497cf21a824ef9e6e17d7cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10228 5404 bytes
font_01_sfnt_off00011472.bin
67d94f3e88d210c8f0ebe79c497a3a34f21994af060c657b102ddc7230cf5a4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11472 11556 bytes
font_02_sfnt_off00013c07.bin
51c407a33f2a051a1e8ba0d35ffdfbb30123b2f0172f8d3cb363dafd9aca9065		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13C07 10340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.