Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3a9ccbaf734b4be…

MALICIOUS

PDF

73.7 KB Created: 2021-05-28 18:44:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 795ff0e364a6c2ffe120e91e90a493ef SHA-1: 28e8b7256ab320d55981f3b0cf9aa0cb2a20a537 SHA-256: a3a9ccbaf734b4bee8286e007de254573ed7eb43c3e256ca3c90ca65eb9a5694
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting services, suggesting it is part of a link farm designed to drive traffic or host phishing content. The embedded document body, though partially corrupted, contains keywords related to 'Wwe 2k18 accelerator pc', likely a lure to attract users to click on the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=wwe+2k18+accelerator+pc PDF link annotation
    • https://fidevawane.weebly.com/uploads/1/3/0/8/130814252/90c847d6d4a8.pdfIn PDF document text
    • https://lepepapiminokuj.weebly.com/uploads/1/3/4/4/134493398/xarididibopuzaj_kikodijemibez_rulevitipujuwoj_disepaveperegir.pdfIn PDF document text
    • https://kodepifaz.weebly.com/uploads/1/3/4/7/134705681/248acaa74.pdfIn PDF document text
    • https://xokumosub.weebly.com/uploads/1/3/1/4/131408432/saregavexu.pdfIn PDF document text
    • https://jebezowurexa.weebly.com/uploads/1/3/4/5/134576847/pesotefeli.pdfIn PDF document text
    • https://leduxuma.weebly.com/uploads/1/3/2/8/132814900/sukajamegaka.pdfIn PDF document text
    • https://zanewodibamejat.weebly.com/uploads/1/3/0/9/130969445/2f9184f86a9f47.pdfIn PDF document text
    • https://xotogifove.weebly.com/uploads/1/3/1/4/131406695/gigazajowi.pdfIn PDF document text
    • https://sigegasolo.weebly.com/uploads/1/3/4/7/134732441/solakerunodipo.pdfIn PDF document text
    • https://tulapubilogu.weebly.com/uploads/1/3/4/8/134881906/bifan_rijoka.pdfIn PDF document text
    • https://vetubopovitomux.weebly.com/uploads/1/3/5/3/135311090/pusubuzolinaki.pdfIn PDF document text
    • https://moxamegok.weebly.com/uploads/1/3/3/9/133999551/3002359.pdfIn PDF document text
    • https://xodomifosipux.weebly.com/uploads/1/3/4/8/134865855/9814310.pdfIn PDF document text
    • https://pevosisonudem.weebly.com/uploads/1/3/7/4/137498794/wuposijuri_voxuzedisepek.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8057d6ee-2f57-47fd-8c0b-21924c6050a3/xuxeveteb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/483c8bf3-308b-4171-b849-71c3a98e3c6a/adverb_of_manner_worksheet_for_grade_2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f61394eb-bb32-4f44-a01e-fe000df1dbd9/como_hacer_la_sangria_francesa_en_word_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c72f4adf-dbfb-4f27-bb5e-7e425926f392/can_you_shoot_a_bow_in_your_backyard_edmonton.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36cd69ed-3c64-4766-b596-83dec2a28108/el_poder_de_la_oracin_en_la_biblia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4a59579-696c-45ae-9c31-5ff8c99fd826/which_religion_is_older_christianity_or_judaism.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64999b34-be6e-4ae0-b9b6-b9cd52c92352/fogajesowerabifoxanegeto.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89af045b-cd58-4d81-9ec7-0a6bd2152ae9/do_sound_dampening_panels_work.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ed70e53-b8e3-4b0f-9747-907db87d4f27/philips_3_device_universal_remote_control_manual_codes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF20 5296 bytes
SHA-256: d3c03c764e052c7efaeedc0fae9ebf575aaa0ecefa85824f354e7d0e3d21d6f6
font_01_sfnt_off0000f15c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF15C 12536 bytes
SHA-256: 1f0dbdbb902f8806d8972e4ee55342e68b61383b94f1bcb8ee082510a85f10d3

Open this report in the interactive analyzer, or submit your own file for analysis.