Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2f54c9e23c15af6…

MALICIOUS

PDF

103.6 KB Created: 2021-03-04 17:18:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 33af2807106a23a171f84362df22fd9e SHA-1: 7bbfc78f4a945ee5ed7b52cdc2f25ce6e7267a43 SHA-256: b2f54c9e23c15af63caab8a21f45544e57cd5681c31050eed7140019a5f7e9e4
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a link farm. The document body, though heavily obfuscated, suggests a lure related to Islamic religious texts, likely to disguise the malicious intent. The presence of external URIs and the ML classifier flagging it as malicious strongly indicate a phishing or SEO spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/wb?keyword=99%20names%20of%20allah%20with%20meaning%20and%20benefits%20in%20tamil%20pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4465396/normal_601be44275c3a.pdfIn PDF document text
    • http://rakadan.sportsontheweb.net/brandy_melville_free_shipping_december_2020.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484156/normal_602217a34a143.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409000/normal_5fe30ca9036e0.pdfIn PDF document text
    • http://bosemefawixuwov.mypressonline.com/93964952821.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384459/normal_5fcfa8fb3c861.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://f1ddcea9-c323-452c-a4d3-aaefec61e50a.filesusr.com/ugd/defd8a_7cfba34499254420823b52d4d7ff3dab.pdf?index=trueIn PDF document text
    • https://72cdfa97-b5fe-44cc-9aa9-3142b5aa642a.filesusr.com/ugd/ee32c9_887e118af36b4b7da0d20d22ef67ad89.pdf?index=trueIn PDF document text
    • https://650c977b-0274-48a2-8498-43c0efc39f4e.filesusr.com/ugd/dbad32_ce40d9e39f214e72baafbf734574c84c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wexoteluwag/anand_shinde_family_information.pdfIn PDF document text
    • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_d67148623f904627ba26521ffaca6316.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kisagoz/insinkerator_evolution_spacesaver_xp_vs_compact.pdfIn PDF document text
    • https://7e8267f5-6380-480e-ad72-df526eaefc07.filesusr.com/ugd/cbe325_fb215bf127cb4cd6a61605f4d1063e14.pdf?index=trueIn PDF document text
    • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_9d3b74aea036494fa4f449efe9f47aa9.pdf?index=trueIn PDF document text
    • https://ea3bc6f2-f4fb-4ed9-994a-b5353b452e97.filesusr.com/ugd/76de1a_e20b702ea7e74e1e9ef792e201a55ff5.pdf?index=trueIn PDF document text
    • http://niwimugosaz.onlinewebshop.net/resistance_tubing_exercise_chart.pdfIn PDF document text
    • https://4cd5eafb-d261-4666-a528-29b55b1676c1.filesusr.com/ugd/8dde66_5f54adb1b483406c95b1049d276a8f07.pdf?index=trueIn PDF document text
    • https://6a1e2a5f-c456-4288-b9d5-5378f87870fb.filesusr.com/ugd/076fac_36088c177b70437ea8f5566b80c59936.pdf?index=trueIn PDF document text
    • https://8767aa75-4bd5-48c0-94ca-24e983238001.filesusr.com/ugd/debdc1_0fabb92dafa4452e8fff15e428259149.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zozuxukoxo/woxilirawemepi.pdfIn PDF document text
    • https://933afb0c-60ca-4ff4-ba38-e7c804ca925d.filesusr.com/ugd/941881_31571b6d5134425cac4e03752f940dff.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00015c2a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15C2A 29136 bytes
SHA-256: 04fb5aea7443684b54d0148b4d7b8789dc7062c7e164156976696445461555d2
font_00_sfnt_off00011148.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11148 5652 bytes
SHA-256: cde570504e37b6aa7f9f690e473b4e01beebbf37d18d94050481b16995a62037
font_01_sfnt_off00012469.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12469 5544 bytes
SHA-256: b486ac641da5fd9b7be291e3b3039beb9c2b002493a01668ab180d88ef746ab8
font_02_sfnt_off00013783.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13783 10700 bytes
SHA-256: ce452df80f02a9e5bb4459b0492549aa0f5bf2c7ae33fddcc309b6afd76da035

Open this report in the interactive analyzer, or submit your own file for analysis.