Malicious PDF — malware analysis report

Static analysis result for SHA-256 b46b38d443b30130…

MALICIOUS

PDF

78.2 KB Created: 2021-06-07 21:13:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 03a0acba7166f86d25034c2cc2a41eb5 SHA-1: 2114cd4a4381aca11ea9b0534626f5e1cd507b32 SHA-256: b46b38d443b30130172922c022ce31f1fcefe897081d3fd0293b7bee685f93cc
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO spam operation. One of the extracted URLs, https://dugedepap.ru/123?utm_term=framelayout+android+xml, is a primary indicator of this malicious activity. No scripts were extracted, but the PDF structure and link farm heuristics strongly indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9958

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=framelayout+android+xml PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4427538/normal_60121dbce8105.pdfIn PDF document text
    • https://degezumibupupek.weebly.com/uploads/1/3/4/8/134862322/2feae65.pdfIn PDF document text
    • https://pusobufuronuwu.weebly.com/uploads/1/3/4/4/134475569/5892963.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450336/normal_60bd02454bb3d.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4480161/normal_60b34e3086cb3.pdfIn PDF document text
    • https://zorepuwozodu.weebly.com/uploads/1/3/4/3/134399810/1219630.pdfIn PDF document text
    • https://labisafedowep.weebly.com/uploads/1/3/4/7/134722654/3486016.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365582/normal_602c5ac31a48d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459479/normal_5ff374844cf13.pdfIn PDF document text
    • https://tiwixuferexo.weebly.com/uploads/1/3/1/3/131380596/sidubez.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/90b050ec-e1b9-41c5-8212-db96a2885f8f/zotowinukajobiduku.pdfIn PDF document text
    • http://sisagexal.pbworks.com/f/tejazuwis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3442fc4b-f05d-4419-bcc9-7076d19789dc/how_to_reset_bios_password_hp_elitebook_840_g5.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8420c2e0-8fc1-4f3e-ae6f-afc7bde4aeb1/what_app_is_lomotif.pdfIn PDF document text
    • http://zajozote.pbworks.com/f/timexexigaruza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/702dbe08-f954-41a5-8bac-2e7b2b02800e/72688753468.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95ac33fe-fa4b-46e2-8569-931e7b6bf8c4/full_marketing_plan_example.pdfIn PDF document text
    • http://punumiboxo.pbworks.com/w/file/fetch/144718902/jimikki_kammal_mp3_song_download_128kbps.pdfIn PDF document text
    • http://gazumadu.pbworks.com/f/36147872550.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/643babbd-c72b-43b3-af8a-bde50965c010/physique_chimie_4eme_exercices_corrigs_bordas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56b8f502-114b-4a27-81f9-c3c15091c767/kebenumugewugerezazu.pdfIn PDF document text
    • http://zusemivak.pbworks.com/f/the_five_love_languages_for_child.pdfIn PDF document text
    • http://podimil.pbworks.com/w/file/fetch/144526191/26871387900.pdfIn PDF document text
    • http://wirajudukim.pbworks.com/f/16169516950.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4153d305-b296-42cf-928a-e3e688a36110/botaruvozerumetubomufe.pdfIn PDF document text
    • http://xoxafepapesu.pbworks.com/w/file/fetch/144424173/bewabusekar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c94fb00f-d03f-4346-ba3f-146e5d41d4b2/7906382826.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ee85103-1a80-4ffe-b269-177328e908de/7601914780.pdfIn PDF document text
    • http://xalomuzavege.pbworks.com/f/cuanto_tiempo_tarda_el_papel_higienico_en_degradarse.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e16e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE16E 4916 bytes
SHA-256: f66968696be23d9d957287d4ea8d54326cb6579401a4a9205199a0615d9f397e
font_01_sfnt_off0000f220.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF220 23444 bytes
SHA-256: f0c2f3b3bf8fdce0f12b3465993eca3d437ec59632da8ca0beaeba69f484bab3

Open this report in the interactive analyzer, or submit your own file for analysis.