Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa3e5691e3649a85…

MALICIOUS

PDF

73.7 KB Created: 2021-05-03 17:32:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 7b558bf34fa6019a0e3c3565b373582f SHA-1: 7672bbf69fca2148914a47616d917d61e2598e64 SHA-256: aa3e5691e3649a85aa5d258e700639ba826e7797ddf9cd98b4876c7a2c434bfc
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=libro+de+ciencias+f%25C3%25ADsica+2+secundaria+contestado PDF link annotation
    • http://instapriz365.online/physics_30_worksheet_4_conservation_of_momentum_2_answersiyklb.pdfIn PDF document text
    • http://creditscorehelp.info/12325263344gbol9.pdfIn PDF document text
    • http://mumolazesinidix.getenjoyment.net/bohemian_rhapsody_classical_guitar_tab.pdfIn PDF document text
    • http://7evenrp.ru/rijotekajisumazo2w6mg.pdfIn PDF document text
    • http://skidki-day.site/bozulesepepdcjq.pdfIn PDF document text
    • https://jonipafatanepa.weebly.com/uploads/1/3/2/7/132741476/gijazegetamil.pdfIn PDF document text
    • http://asta-stroy.ru/1520815237850kij.pdfIn PDF document text
    • http://triple-doska1.club/16965980413byj63.pdfIn PDF document text
    • https://menanotiji.weebly.com/uploads/1/3/4/3/134322389/zorefozosinaparazes.pdfIn PDF document text
    • https://dalulasu.weebly.com/uploads/1/3/4/4/134493325/376897.pdfIn PDF document text
    • https://kexekogu.weebly.com/uploads/1/3/1/3/131384418/zidekopitenepo.pdfIn PDF document text
    • http://ketosimple.online/367653564549z3dc.pdfIn PDF document text
    • http://raponikidosal.getenjoyment.net/samsung_refrigerator_rf26hfendsr_aa_parts.pdfIn PDF document text
    • http://asta-stroy.ru/how_to_put_a_heavy_duty_stapler_back_togetherk7pgd.pdfIn PDF document text
    • https://gamevuwi.weebly.com/uploads/1/3/4/5/134525912/naniwujokulofo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://965bd944-310b-4209-a71a-d16e45aaced4.filesusr.com/ugd/5f02e6_51a2bdf4510747d5afe0880f733e5144.pdf?index=trueIn PDF document text
    • http://vebusatoro.atwebpages.com/8752645496.pdfIn PDF document text
    • https://c06d174a-caca-4ab2-b5a0-4525cd3135d4.filesusr.com/ugd/856cea_95c05eef20554a0091aa00495baa0691.pdf?index=trueIn PDF document text
    • https://88e92b2d-3ddf-41b2-a2ae-4af48bfba274.filesusr.com/ugd/b74686_d66a5e32767e41f48c6df70cf13a3747.pdf?index=trueIn PDF document text
    • https://67bb8873-ca08-4da4-87c0-60a8072ebff6.filesusr.com/ugd/a838c0_46a5006a7cac4e54a4c82bafdbb18c65.pdf?index=trueIn PDF document text
    • http://bitines.myartsonline.com/sibubixur.pdfIn PDF document text
    • https://39472683-7d43-4bc3-882b-0947a83fd973.filesusr.com/ugd/544c7e_8aca5d771ef347af9b5aaf27610b4f7b.pdf?index=trueIn PDF document text
    • https://0ca3454e-05ac-49fc-8d00-644b1af7be3c.filesusr.com/ugd/8bf3fc_1daefff56a2241d0a81b4c1ecc27edba.pdf?index=trueIn PDF document text
    • https://cad90261-f038-4e8a-b384-2e0e37e6cb8c.filesusr.com/ugd/4c4e45_a8d11c7f15c0429a8591f4f7b67e96ce.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ddf9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDF9 5248 bytes
SHA-256: 61d30bd5ad85b4eb1a590a06353bdbcab6ae2d49ce9c34c54c227171806e847e
font_01_sfnt_off0000efea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFEA 11800 bytes
SHA-256: b4694182c016a0103d2d3672c948c5bec0f23c35fe9ee3b6f3bfa3ef09322d5c