Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d119fa4ae764b08…

MALICIOUS

PDF

91.5 KB Created: 2021-06-10 03:29:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 4311c9dc3024ad1ed6ec65686f864b88 SHA-1: 339693f230fb8bb63334f005b5e8aea77897cc3a SHA-256: 9d119fa4ae764b08b14556e663f9d3ea7c00d51ea21e001f4062a59bbfdfaefd
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to disposable hosting, indicating a link farm designed to direct users to malicious sites. ClamAV and ML classifiers confirm its malicious nature, identifying it as a phishing or trojan PDF. While no scripts were explicitly extracted, the PDF structure and link farm behavior are indicative of a spearphishing attachment used to lure victims to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=download+gcam+redmi+6a PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4408875/normal_5ff2768f43c08.pdfIn PDF document text
    • https://budovabi.weebly.com/uploads/1/3/4/5/134510119/bisuni-pulexo-fivat-gizapeku.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425484/normal_604e6e838eddd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445735/normal_5fceb3a0c3bbe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420019/normal_6034c5185a282.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377674/normal_5fe1f739c0799.pdfIn PDF document text
    • https://pevumufaropis.weebly.com/uploads/1/3/4/7/134706438/bopadafanaba.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb9f7656-d06e-42c3-bea3-cf360096c049/day_after_tomorrow_sequel_release_date.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f382eea-d75f-4776-9396-349d56804c4f/radio_thermostat_wifi_connection.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfdb09d2-1aa2-4a36-9f3d-754069b3f4a2/how_to_get_free_skin_in_mobile_legends_2019.pdfIn PDF document text
    • http://mijatonevu.pbworks.com/f/55314474580.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f7bd1c2-be14-43a5-8e9b-8ea73bce4801/what_is_the_national_peer_review_committee.pdfIn PDF document text
    • http://nusuwoxub.pbworks.com/f/is_there_no_netflix_app_for_ipad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78499782-b704-401e-b62d-8ae09b306629/stevens_320_security_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b18de39-c5bd-4a24-8481-c1fadd6e0bfa/92896671922.pdfIn PDF document text
    • http://finatin.pbworks.com/w/file/fetch/144500298/femigoxawi.pdfIn PDF document text
    • http://xugatun.pbworks.com/f/feasibility_studies_for_building_projects.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d7e9b65-5052-4c18-ba98-bd63d1dc639c/53524218045.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec01de29-c67c-470d-b540-83974cfd1e67/predicacion_de_cash_luna_el_poder_de_la_oracion.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e44b85b-799f-4a07-a823-323a48e6f397/wameduwifusopuxudetak.pdfIn PDF document text
    • http://gezebal.pbworks.com/w/file/fetch/144753774/96871367001.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b259c2ec-5bbb-4351-b046-7a5666fe0426/download_lwarb_beta_ios_11_profile.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/825fb42a-d91c-4624-acda-9fa3b036f875/can_i_update_my_panasonic_viera_tv.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001288e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1288E 5324 bytes
SHA-256: 6ed370e042967440c2b1d26fff6f8d24f8214d67ff31af6d777d953111c7170f
font_01_sfnt_off00013aaf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13AAF 11088 bytes
SHA-256: 9b4a3fad46c05a21c4f964e1562580372aa985a8b0a8318f7741afbe7b9de113

Open this report in the interactive analyzer, or submit your own file for analysis.