Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e2df39691137970…

MALICIOUS

PDF

77.1 KB Created: 2021-04-13 20:07:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: a6759c8dd769e8b65ff72643098854e2 SHA-1: 6eca9a4c9fc8c68ed52b69b35f4a90c225c63143 SHA-256: 9e2df396911379701d42ccbec872c1f376afedf6ef5f7f30de9bed82b45e8677
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to S3 buckets and other benign-looking PDFs, but also includes a redirector URL (https://gimoguvi.ru/strik?utm_term=microsoft+visual+c%2523+step+by+step+8th+edition) disguised as a free download lure. This pattern is indicative of a phishing or malware distribution campaign, likely using the document as an initial lure. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=microsoft+visual+c%2523+step+by+step+8th+edition PDF link annotation
    • http://pafowitowa.medianewsonline.com/fuwumedupojexorivuvebi.pdfIn PDF document text
    • http://zafenoro.scienceontheweb.net/fumodobiga.pdfIn PDF document text
    • http://bepufuz.22web.org/9044625.pdfIn PDF document text
    • http://lufexaxoxak.mygamesonline.org/access_microsoft_tutorial.pdfIn PDF document text
    • http://mofirixubutibi.getenjoyment.net/30012977931.pdfIn PDF document text
    • http://tosefabebiribow.scienceontheweb.net/alchimistul_din_tine.pdfIn PDF document text
    • http://gabameled.22web.org/x-_band_rectangular_waveguide_dimensions.pdfIn PDF document text
    • http://jawazapefaxuzit.mywebcommunity.org/gurozejipowurexukomij.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/vofadoloves/gizedogevod.pdfIn PDF document text
    • https://s3.amazonaws.com/luborinizu/nevonefumolob.pdfIn PDF document text
    • https://s3.amazonaws.com/vavapekadoliti/74382183568.pdfIn PDF document text
    • https://s3.amazonaws.com/wexoteluwag/what_plate_boundary_does_seafloor_spreading_occur_on.pdfIn PDF document text
    • http://zisukuvi.atwebpages.com/business_environment.pdfIn PDF document text
    • https://b9a4c3d6-4ccf-4d04-9b0f-c2e9c357e15d.filesusr.com/ugd/e5cbe5_4f6d638246574ec3af73a1861cbf93fc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pazatuv/apa_style_guidelines_for_tables.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/pride_and_prejudice_quotes_mrs_darcy.pdfIn PDF document text
    • https://357b8bef-7330-4cfe-b31d-389db25c4d5a.filesusr.com/ugd/4c76bf_5a7742bc65a24fdc82617c773ab4fc65.pdf?index=trueIn PDF document text
    • https://d1b6b380-f15b-462b-86b5-0b089ba7d90d.filesusr.com/ugd/f99a33_c7c51ab1699b44348fdd5bc1e255b5f0.pdf?index=trueIn PDF document text
    • http://fazozogujezeto.rf.gd/2d_game_engines_free.pdfIn PDF document text
    • http://zilidezokap.epizy.com/the_invention_of_lying_movie_free.pdfIn PDF document text
    • https://00407fa8-a9ef-4b78-9bbe-46147fc8acf6.filesusr.com/ugd/5ecadc_745b2b12cb9d4641adf4f4d54a2e578e.pdf?index=trueIn PDF document text
    • http://sesenin.rf.gd/teorema_del_valor_medio_ejercicios_resueltos.pdfIn PDF document text
    • https://19d8af67-ac20-4a7c-8ffd-69be953788a8.filesusr.com/ugd/578741_4127a4da78f54c5685440dd1789933a3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pogolo/50859064780.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e564.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE564 4600 bytes
SHA-256: 056cfe6a37da97c7a5e8f0db1adc64e222592ca611a7fd4132544c218c847acd
font_01_sfnt_off0000f51a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF51A 10508 bytes
SHA-256: 09c626700b804cdf09f29b0bcb3931fb4f9f98fecec302bf5ef075366fc965bd
font_02_sfnt_off00011923.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11923 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.