Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1b8f72b09de458c…

MALICIOUS

PDF

80.4 KB Created: 2021-03-23 20:17:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1b124820251c0607050a5d1a17facf38 SHA-1: 1fb6c85ee3aaa1c9f0d23fdb2bb5c4c0a93a3e9e SHA-256: a1b8f72b09de458c63fffb8c1bae8eab1d4a1d6f0512fde8db08760bc810ccc6
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO spamming operation. The 'SE_INVOICE_LURE' heuristic suggests a pretext of an invoice or payment, which is common for phishing. ClamAV detection and ML classification confirm its malicious nature, likely as a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 7

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=accounting+words+list+pdf
    • http://mopowataxix.medianewsonline.com/cabinet_ministers_list_2020_in_gujarati_language.pdf
    • https://static.s123-cdn-static.com/uploads/4472776/normal_5ff820a113ed4.pdf
    • https://static.s123-cdn-static.com/uploads/4370051/normal_5fe01936f282b.pdf
    • https://cdn-cms.f-static.net/uploads/4457318/normal_604910db50322.pdf
    • http://wutopezogegusi.getenjoyment.net/kululamasexojilon.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://foxukekamusun.onlinewebshop.net/32579396232.pdf
    • https://s3.amazonaws.com/bipovoromoj/what_to_do_when_buying_2nd_hand_car.pdf
    • http://tebuwawezizafes.onlinewebshop.net/sizesedawidixediwamu.pdf
    • https://02408c19-b9f6-4996-a596-1d5b7e46c8d3.filesusr.com/ugd/c83fdb_50b0260493624185818e23b5514b165c.pdf?index=true
    • https://d9226533-59f4-4737-ae77-cfa9cdee5378.filesusr.com/ugd/d7c203_2c2ddaf723fd406493f888135387077e.pdf?index=true
    • https://s3.amazonaws.com/zategafozasiru/puwoxowadirewemokapixefu.pdf
    • https://13a7c488-548c-4b48-b567-d2b0b9a3e1de.filesusr.com/ugd/85d67f_77465c1ea69049a1a031ea3d8dac0fb9.pdf?index=true
    • https://ac263381-fdad-4fda-ae78-6df6d71032d6.filesusr.com/ugd/25c42e_3c5f96518e714d82b9d9775603513f05.pdf?index=true
    • https://8533cbf3-c0d6-400c-bdf8-8ca38cf0242b.filesusr.com/ugd/135178_e3cef00f7c8f4e49aeaa236306f5ce39.pdf?index=true
    • https://s3.amazonaws.com/gupojakami/87230076597.pdf
    • https://60ceb029-6f78-4d42-8ea4-15ca08d8077a.filesusr.com/ugd/857e61_9d64abc92e13472f9114691067bb4ccd.pdf?index=true
    • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_62cf70560af245d1b278090e244505f5.pdf?index=true
    • https://a49a6154-edc8-4132-95a2-c7bb8d673fe9.filesusr.com/ugd/551169_ae24b523c0a541d4abe65f43aae9f09d.pdf?index=true
    • https://907864b8-ab38-4b43-b195-7646ee37c451.filesusr.com/ugd/c4b402_d7855aed7bc846f4b948cfd2d87bf3b4.pdf?index=true
    • https://s3.amazonaws.com/figugipopar/zunogitoguxo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eea5.bin
9e9250f3f8bd804a7c77f4a4ddf8c976e45653de54504bc7fd10b5bbfc03b0c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEA5 4956 bytes
font_01_sfnt_off0000ff96.bin
abd6a54408386ac5e98cdc6ad0b4155eed28070c64897c7c3fdd6573ffd467b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF96 11296 bytes
font_02_sfnt_off0001261c.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1261C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.