Malicious PDF — malware analysis report

Static analysis result for SHA-256 b82f52f0c436b6f6…

MALICIOUS

PDF

112.9 KB Created: 2021-04-21 19:33:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 066ad404a9ac95dd897208a1fdd36002 SHA-1: e8fe68cc66887c18c742541f226166b06398a9c0 SHA-256: b82f52f0c436b6f6cce7db981f7f46090057ed4e0d00cd5bb0e3495128a8e41d
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO manipulation tactic. One of the embedded URLs, 'https://fokemale.ru/strik?utm_term=vishnu+sahasranamam+names+list+in+sanskrit', is particularly suspicious and likely leads to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=vishnu+sahasranamam+names+list+in+sanskrit
    • http://sizijevoji.iblogger.org/hp_deskjet_d2545_printer_driver_download.pdf
    • http://voninizi.iblogger.org/betpawa_apk_tz.pdf
    • http://xedeporib.medianewsonline.com/jatizoxeliwakuzipi.pdf
    • https://cdn.sqhk.co/genepajev/tNhgUji/rupopedaxoliraneludezo.pdf
    • http://biniwitovo.mywebcommunity.org/67626070270.pdf
    • https://cdn.sqhk.co/sijiposago/hahdTih/color_by_number_printables.pdf
    • https://cdn.sqhk.co/modonasuje/ihOtESA/starz_power_book_2_ghost.pdf
    • https://cdn.sqhk.co/noxomosanena/Kjcouja/66020019013.pdf
    • https://cdn-cms.f-static.net/uploads/4421205/normal_601487fb49097.pdf
    • https://cdn-cms.f-static.net/uploads/4404955/normal_601f7b82ea35e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ef2e072a-e8a2-4438-804d-cc750be2e2f6.filesusr.com/ugd/6a22cb_0d531554f8724c168c4bc513112867eb.pdf?index=true
    • https://ed4d48c2-14ea-47f5-a89a-b82193587323.filesusr.com/ugd/8ce377_92ae91e7b9e84fe2a2158b5089b20f34.pdf?index=true
    • https://uploads.strikinglycdn.com/files/de3d4ce2-2280-4673-a5a8-d3c7d128a151/hewlett_packard_laserjet_4_plus_ink_cartridge.pdf
    • https://334e481f-4595-4613-8514-cf1b68b0f675.filesusr.com/ugd/a5bb32_e00e6c8e274149ce9184f94c3f064898.pdf?index=true
    • https://56352102-112a-4456-a677-0775450c4ed3.filesusr.com/ugd/ed4e87_54b594d338cc460d92e4e4e67738c604.pdf?index=true
    • https://165b0ab0-89c3-4517-b88f-e2bd0c55d975.filesusr.com/ugd/97b555_d719abd788cd4f4190624ad5195dee57.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9dbf3295-60af-42bd-9aef-a394d2b3b92a/doduvi.pdf
    • http://sasavinoseg.epizy.com/20287528907.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017f25.bin
b999b0adce00fb9db27725f380dd05661fccc0b0735f04fcbed5698bcdeacb44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17F25 4952 bytes
font_01_sfnt_off00018fd4.bin
5ada44829d1880e8be9d9855404d38cb03cacf18348d1258cc03f67b840d9ed7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18FD4 10772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.