Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac202ce707813bc5…

MALICIOUS

PDF

70.1 KB Created: 2021-10-03 06:07:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-23
MD5: b8d3e5d0f8634c7961af182aa29b0aff SHA-1: 4c6661f252332edc4c901134797fcf7a523ed9e8 SHA-256: ac202ce707813bc52ce24b40d4948db9f2984b4ea9c4913c13a3ae51f572a09e
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as a malicious PDF by ClamAV and an ML classifier. It contains numerous external URLs, many of which are hosted on disposable domains and appear to be part of a link farm, suggesting a phishing or malware distribution scheme. The PDF structure and embedded URLs indicate it is likely used as a lure, potentially for spearphishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/uplcv?utm_term=guardian+authorization+letter+for+school PDF link annotation
    • http://omgmediatank.com/userfiles/files/63248027349.pdfIn PDF document text
    • http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/3k83e4co8putq4pcc7776r7254/dulugamiwuka.pdfIn PDF document text
    • https://idealist.ro/userfiles/file/81744832174.pdfIn PDF document text
    • http://zavalinka.by/var/upload/file/60241728497.pdfIn PDF document text
    • https://fiscalonline.eu/app/webroot/files/userfiles/files/matuv.pdfIn PDF document text
    • https://www.la-melodie-des-saveurs.fr/ckfinder/userfiles/files/14356137986.pdfIn PDF document text
    • http://yetisirkaucuk.com/firma/files/dunolokubetujab.pdfIn PDF document text
    • https://congchungnguyenlieu.vnpec.xyz/uploads/files/nusepaxizavudo.pdfIn PDF document text
    • http://maymaygiaydachidang.com/upload/files/vixosoxab.pdfIn PDF document text
    • http://euroambulans.pl/userfiles/file/85671328311.pdfIn PDF document text
    • http://technestudio.eu/userfiles/files/53274157430.pdfIn PDF document text
    • http://facyt.com.ar/ckfinder/userfiles/files/jawudowusiwo.pdfIn PDF document text
    • http://e-baze.lv/images/site/file/43085190065.pdfIn PDF document text
    • https://ka-base.no/images_students/files/dufafajabofi.pdfIn PDF document text
    • http://hwayinn.com/image/files/20210916_105834.pdfIn PDF document text
    • https://camile.vn/wp-content/plugins/super-forms/uploads/php/files/1b3bvanhov99lp7he75g4k3k84/68214243415.pdfIn PDF document text
    • https://www.hippocratio.gr/ckfinder/userfiles/files/lekesegemuvex.pdfIn PDF document text
    • https://illustrations.noche.fr/images/files/nagolasofevimujapegamipar.pdfIn PDF document text
    • http://youngshiny.com/userfiles/file/1631958765.pdfIn PDF document text
    • http://rucodelniza.ru/userfiles/file/judanudeg.pdfIn PDF document text
    • http://zlhk.ru/upload_picture/file/69241745253.pdfIn PDF document text
    • http://xinxinhouseware.com/uploadfile/files/75707271093.pdfIn PDF document text
    • http://nomorecpapmachine.com/userfiles/files/kiropujokegufo.pdfIn PDF document text
    • http://panova-art.com/files/file/4627657901.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b162.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB162 15160 bytes
SHA-256: 623275d6ba0f55ae3d657d2ee74611e118cf799847c4e49a16ba569126030565
font_01_sfnt_off0000d7af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7AF 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000efc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFC6 10772 bytes
SHA-256: 06995940d57fe0be1b26d51a9fa18059658431bbf0b7c73687b0dded303b99ef

Open this report in the interactive analyzer, or submit your own file for analysis.