Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e9f18b61cbff905…

MALICIOUS

PDF

108.5 KB Created: 2021-03-10 18:31:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 570e3e151671248c69c6d4092f780241 SHA-1: de3f53a53a5db618f25d3eeca2f7cbab1ecf6433 SHA-256: 9e9f18b61cbff905299f887f5e18d806aa79a178ece9bd5d4cd8b1e5cffefd9b
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or phishing lure. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or distributing further malware. The document body is heavily obfuscated and contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDF documents from web content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9962

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/aws?utm_term=left+alone+synonym+definition PDF link annotation
    • https://cdn.sqhk.co/parikozug/fAEghMH/vetigadozeru.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455639/normal_5ffdf912e43e5.pdfIn PDF document text
    • https://cdn.sqhk.co/rarukaboz/QjfBjGH/minecraft_new_update_1._16._2.pdfIn PDF document text
    • https://cdn.sqhk.co/pezolaje/ejSjhih/dream_daddy_mat_voice_actor.pdfIn PDF document text
    • https://viwalamul.weebly.com/uploads/1/3/3/9/133997630/nalewerew.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486359/normal_5fcef635e1c82.pdfIn PDF document text
    • https://dupigonaw.weebly.com/uploads/1/3/5/2/135297060/a53bfb7.pdfIn PDF document text
    • https://zojovotonoturur.weebly.com/uploads/1/3/5/3/135348007/kinetetetufas.pdfIn PDF document text
    • https://cdn.sqhk.co/pelopuxi/rjbggie/45310179893.pdfIn PDF document text
    • https://cdn.sqhk.co/zotipimesaza/aKWbhje/71710326241.pdfIn PDF document text
    • http://jalazekesofijot.medianewsonline.com/dell_optiplex_790_network_drivers_windows_7_32_bit.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366359/normal_5ffb5b353d735.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464877/normal_6027439e6a4ff.pdfIn PDF document text
    • https://bokuwiziwa.weebly.com/uploads/1/3/4/0/134042705/zosazixegexupadeni.pdfIn PDF document text
    • http://lezigovedavide.getenjoyment.net/how_to_review_photo_tags_on_facebook_before.pdfIn PDF document text
    • http://morasuxod.getenjoyment.net/27696127734.pdfIn PDF document text
    • https://zapilututok.weebly.com/uploads/1/3/4/3/134341349/nunovexafe.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://kanuximus.rf.gd/barbie_girl_dance_song.pdfIn PDF document text
    • http://lajonapeloros.rf.gd/gemekemiribajozarede.pdfIn PDF document text
    • http://gusosowir.rf.gd/82989582802.pdfIn PDF document text
    • http://mawidinivetobi.myartsonline.com/83219627440.pdfIn PDF document text
    • http://sokexodine.rf.gd/aviation_capital_group_annual_report_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/acab3ae6-3176-400f-a1c1-ca09de27b941/best_navy_jobs_for_females.pdfIn PDF document text
    • http://lejarojat.rf.gd/motorola_bluetooth_headset_pairing_iphone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1da95e9-d2d4-4199-9b6d-010a8b745e4f/excel_2013_keyboard_shortcuts_cheat_sheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0001739b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1739B 20420 bytes
SHA-256: 8d28b4d956680107eae1c5b89149a352351a95847c6d2e4a46cd4de1f26be4c9
font_00_sfnt_off00011378.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11378 5312 bytes
SHA-256: 93d6c3ebd95e17c0b16b5f7c951f45470812e17585a28bfa16aa85370f66aa0a
font_01_sfnt_off000125f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125F4 5000 bytes
SHA-256: 94d4eb6129a5c60d92ddbe0473649ce96806e1027c8c108a2d219c8bf283744e
font_02_sfnt_off000136eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x136EB 7044 bytes
SHA-256: 45603d2c396672e5ccffc594bfe9b14fab78a838d36ac64ec2344e2b0dc2ed8a
font_03_sfnt_off00014a0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A0D 12672 bytes
SHA-256: 5f5fcb98db46f707909e05e576705f04ab9bc5abff4a649f0791bc67e2176d80
font_05_sfnt_off00019569.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19569 3420 bytes
SHA-256: a32ce48b39f28f6585cf7bc6df58156e79c8be11d3d74059a6769cf02beae5b0

Open this report in the interactive analyzer, or submit your own file for analysis.