Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1d8c917f4a22f59…

MALICIOUS

PDF

99.8 KB Created: 2021-05-08 14:27:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 79b1abc6e3748583672add99cf2be548 SHA-1: bcd4fe15a0a4e17885db566ed0948e3c8eb38d1b SHA-256: a1d8c917f4a22f5947f02ef2e0dd86426a7410432082b65f2709cbacb20cdd3a
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It functions as a link farm, embedding numerous external URLs, with a primary focus on redirecting users to a suspicious domain. The PDF's structure and embedded links suggest it is designed to drive traffic to potentially malicious websites, possibly for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=best+dunkin+donuts+iced+coffee+for+weight+watchers PDF link annotation
    • https://cdn.sqhk.co/pajokiman/hFje5jj/76796948591.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377931/normal_6004b61ea369d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454300/normal_60221be91a2bb.pdfIn PDF document text
    • https://cdn.sqhk.co/kujexelorite/Vijhgji/flipper_bird_purple_shep_pokemon.pdfIn PDF document text
    • https://cdn.sqhk.co/gebemiwisero/ibpvTgf/motosport_phone_number.pdfIn PDF document text
    • https://cdn.sqhk.co/savunowudob/iihcsjf/can_you_escape_adventure_level_1.pdfIn PDF document text
    • https://cdn.sqhk.co/mudinaxape/hghjujb/bad_grandpa_full_movie_cast.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://ff0b3df2-dc61-4aeb-9024-93fa9b5bc175.filesusr.com/ugd/aa14a9_53662d1ffa334dffb89eec1c4a40c46e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vigevot/6886191014.pdfIn PDF document text
    • https://s3.amazonaws.com/dozuga/72105548798.pdfIn PDF document text
    • https://67dc9804-4028-4298-afd7-d431d2c16fe6.filesusr.com/ugd/559c84_6284c6a0414e448692063afb4232e8df.pdf?index=trueIn PDF document text
    • https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_6d529e53bda346b6bb0e664ccfe81967.pdf?index=trueIn PDF document text
    • https://e8802323-0824-40c5-8a58-19d700e27586.filesusr.com/ugd/50cafd_c37a7f8928fb409593aa6e7f8cef0f47.pdf?index=trueIn PDF document text
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_6644b4fd5e7f4df3acf76b877bb3d32e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d9628b6-df65-4c93-8945-08df4ad88300/how_long_does_dyson_dc59_battery_last.pdfIn PDF document text
    • https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_fc33ce7f10c04a489b9105099744c329.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/betefowubevat/madame_bovary_2014_parents_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/dojivewobasuval/56177794284.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67d9f962-2bfb-4b73-b757-1df7a755fa31/nazm_hikmet_ilk_iirler.pdfIn PDF document text
    • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_da863aead5c444758b92b7686ca215fa.pdf?index=trueIn PDF document text
    • https://7afd96e6-4611-46d4-9b98-d111b897c281.filesusr.com/ugd/154221_f0fe044be6c34c618fc49d4a359f47af.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013494.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13494 5336 bytes
SHA-256: 5b445a534c973c03cc8f8bd55ad128b767e73212bb672bee610b9d503aeb6815
font_01_sfnt_off000146cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x146CB 13500 bytes
SHA-256: d95d3fc3229ef94ad3fd0cb0adf14e3ba236037900106e8a177f178548713c9e
font_02_sfnt_off00017363.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17363 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.