Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac42b0c5965795df…

MALICIOUS

PDF

75.2 KB Created: 2021-03-08 17:00:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 54934c9ced07f89bc524a279893a55e6 SHA-1: c85f18e7dac89df37e1588148e89d65d3c9d9eaa SHA-256: ac42b0c5965795df244dfba7759d4bdc116361ff46cd7fda2c2e4d9ed10a0f62
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded links, many of which point to disposable hosting or redirector infrastructure, indicating a link farm designed to distribute malicious content. One critical heuristic identified a link to known malicious redirector infrastructure. The ClamAV detection and ML classifier further support its malicious nature, classifying it as Pdf.Phishing.Trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/wix?keyword=robotics+competition+2020 In PDF document text
    • https://static.s123-cdn-static.com/uploads/4417306/normal_5ff4239540e94.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494165/normal_604542d3073e9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412591/normal_602e39258c52a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bepidinotovat.rf.gd/96649257079.pdfIn PDF document text
    • https://254b3b0b-79dc-4992-827c-fd4bb3db3178.filesusr.com/ugd/f515ca_05f74f74b7f94d388f3543f2633c7fc9.pdf?index=trueIn PDF document text
    • https://d2d87fd5-5f4d-49aa-ab3c-2263ce4b5d22.filesusr.com/ugd/9169d2_2cec0ec66c8242728c4ac4dee3779549.pdf?index=trueIn PDF document text
    • http://vaberizop.epizy.com/fancy_text_generator_apk.pdfIn PDF document text
    • https://39c1d623-eccb-4af0-a86a-15328a2d61f9.filesusr.com/ugd/3cb6cb_b0c91f9979a54b9596cd794e2f091626.pdf?index=trueIn PDF document text
    • https://d497f082-4895-42de-a72c-038d9367c8a3.filesusr.com/ugd/8e727b_4606b45490d14e4faec474b8ac38098d.pdf?index=trueIn PDF document text
    • https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_66dcf558ad1c4d45bc0cd3c73d0f28c7.pdf?index=trueIn PDF document text
    • https://7ef7ebf0-bcb0-4ca2-8538-5a19c3e9f01c.filesusr.com/ugd/aff7ca_2cc21fc527104bf9b95911599f4526b2.pdf?index=trueIn PDF document text
    • https://f64a1a0a-debf-4843-a838-a34c0cae0f4a.filesusr.com/ugd/89602e_51f78aaeb52645faaee6308ec5f520b9.pdf?index=trueIn PDF document text
    • https://305aa2e3-e1d2-413d-aa2e-f1bb83d03ded.filesusr.com/ugd/92ee2b_bb3bef353bd24d2aa6d9698ab8c253ab.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vipuxafol/77593318329.pdfIn PDF document text
    • https://s3.amazonaws.com/bifamomove/51886997984.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e05f0c7-f3c4-4517-92c9-b468b2541e2e/lizixukiguma.pdfIn PDF document text
    • https://s3.amazonaws.com/nitirew/93591298461.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c35bb3a-cd12-4a25-b8b6-99b4270d14ed/22259518196.pdfIn PDF document text
    • https://777dd155-384c-4f1d-a337-8f27b94bb056.filesusr.com/ugd/1ecdae_2d1714795d8148799125d192f51c6db3.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b51f660b-4804-422e-8185-c7517d004505/learn_to_read_hieroglyphics.pdfIn PDF document text
    • http://pagupim.epizy.com/8090992674.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA59 5160 bytes
SHA-256: ebcd125790019f6cd30c3a32b8e32ef2a8c9e63c2f1bc4d3acd94d5e93d26992
font_01_sfnt_off0000fbdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBDD 10592 bytes
SHA-256: fd425ebd555019b3e444f16b58a4d743039184e235ccf06a4667635e29c90176

Open this report in the interactive analyzer, or submit your own file for analysis.