Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa43d4a1ea5b5680…

MALICIOUS

PDF

73.1 KB Created: 2021-09-27 13:45:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: fe89d64576aa31bf1009dbc1fd5cb8f8 SHA-1: 62154cba28b951887de13d0a6733b012316dafdc SHA-256: aa43d4a1ea5b56802fbfe4c591ba59aa250e92e7685da51c8ae488ca4ba04648
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous embedded URLs that redirect to other PDF files, suggesting a link farm or redirection scheme. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a high likelihood of malicious intent, likely to distribute malware or conduct phishing. The ML classifier and ClamAV detection further support the malicious verdict, pointing towards a phishing or trojan distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9973

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://confidence-ist.com/ckfinder/userfiles/files/40725589137.pdf
    • http://agppi99.pretty-match.com/upload/files/11877479128.pdf
    • https://istruttorecinofilo.it/userfiles/file/87046170343.pdf
    • http://hondaotohaiphong.vn/upload/files/1887588384.pdf
    • http://www.stadion-zarya.ru/ckfinder/userfiles/files/tulofudepereravaresebebib.pdf
    • http://bio-scan.com/userfiles/file/26278930828.pdf
    • http://tvsatkrosno.pl/userfiles/file/1556812010.pdf
    • http://pvvc.cz/files/97730504532.pdf
    • http://nova-auto.com/upload/69642840930.pdf
    • https://flardochform.se/userfiles/file/68539109642.pdf
    • http://soosanfix.com/upload/fckeditor/file/kefezawiv.pdf
    • http://lycee-elm.info/userfiles/file/31827699756.pdf
    • http://noavarservice.com/ckfinder/userfiles/files/pedaronanujoxobagibi.pdf
    • https://mldom.xyz/web/img/podborky/files/fupeboli.pdf
    • https://fa-vietnam.com/webroot/img/files/75353597212.pdf
    • http://sfipl.in/userfiles/file/62509437819.pdf
    • http://modulobase.com/userfiles/file/34341742652.pdf
    • http://betheaskssd.com/flash/betheaskssd.com/file/dazonizalewisezuvajonawet.pdf
    • https://indoshaolinkungfusociety.com/ckfinder/userfiles/files/wozutevu.pdf
    • http://www.niceresidence.net/image/upload/File/37097896424.pdf
    • http://tzsunup.com/upload/daviwovofav.pdf
    • https://phr4u.com/files/19655047731.pdf
    • https://braviengenharia.com.br/wp-content/plugins/super-forms/uploads/php/files/nketrfj4ikpr9ogslj2heotdk7/lefozaj.pdf
    • http://hkacca.com/userfiles/wefakopenujajabazotujedup.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=telechargement+whatsapp+pour+android+gratuit
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b80e.bin
ef906550ed8eb006645714368b4be458b167f081eb64e10d4af0d0c07d83e3e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB80E 11112 bytes
font_01_sfnt_off0000d1a8.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD1A8 16792 bytes
font_02_sfnt_off0000e9ba.bin
ec7e442dbbaea05a600f5c8517db0581c6b52da9414cad04d42b435e0c0f1501		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9BA 17316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.