Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdc9c843570829aa…

MALICIOUS

PDF

165.8 KB Created: 2021-03-04 23:02:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: 5419e9cb23598e4664560c92d5094be5 SHA-1: ef9c3f2b64975eb4a804d0556c4600b69ce26394 SHA-256: bdc9c843570829aa0cd17c4c52064211bf30f9167b5a5db0cae9411ad284a7df
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV. It contains numerous embedded links, many pointing to disposable hosting, and one specific URL is associated with a search result lure for guitar tabs. The PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates a link farm strategy, suggesting the document is designed to redirect users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/aws?utm_term=river+flows+in+you+guitar+tabs+download PDF link annotation
    • https://juwulonureli.weebly.com/uploads/1/3/2/8/132815178/3237672.pdfIn PDF document text
    • https://torovuzexas.weebly.com/uploads/1/3/2/7/132710592/5432368.pdfIn PDF document text
    • https://sibetufubexab.weebly.com/uploads/1/3/2/7/132712005/b97f458b10.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/kavifunaruvi/microsoft_word_template_certificate_of_completion.pdfIn PDF document text
    • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_0b27e7348ccc4686851e730b6b12ca52.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tetofamuxulil/pifurise.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5d8a8193-aaa8-43ab-b7f2-269f7bf95336/sony_dream_machine_clock_radio_icf-c414_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3fb8dd25-5e51-4943-9df1-dfc36dad5656/weber_grill_restaurant_chicago_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/caceb39a-c17b-4e14-8aff-b2d7148dcb9c/bejiraxujowagedi.pdfIn PDF document text
    • https://s3.amazonaws.com/silubebebefuju/yahoo_messenger_free_for_iphone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a04005f6-e628-4541-a3e7-45dbdccdce1f/the_elite_kiera_cass_characters.pdfIn PDF document text
    • https://s3.amazonaws.com/tigovatolis/lexeduvotanikolon.pdfIn PDF document text
    • https://4c72699b-aa2e-4dc8-8bd5-1a54e8f938a6.filesusr.com/ugd/f3cb45_22dc0a8cdfe34ea7a07704e60f9589d5.pdf?index=trueIn PDF document text
    • https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_a1e7a941d7eb40ccb7b20d5a136fa656.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vovabagubajegeb/gimevigigewovab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0979717-658a-4793-8cc8-cb1279465d0b/55830023495.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/39c70bd5-b489-4ca0-b040-ea52c7974031/vivumebigotuverubivekesa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b49f97ab-aa04-496a-989c-fd93606e46a8/a_history_of_western_philosophy_amazon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8bca2bdf-da16-4f3a-bd2e-466be796f6fd/sap_fico_online_training_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3614d43-a4fe-4410-935b-5fa603f76404/81035782171.pdfIn PDF document text
    • https://c4a5d104-04f9-44e6-b03f-1f5edac3680f.filesusr.com/ugd/f23921_9efd0e7f8cda4c6699f694d24bdf7e12.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000230de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x230DE 5360 bytes
SHA-256: 5c65a4a9479f87174ec52b418abe540c4fcafeb80642f5663f1036d3f007797c
font_01_sfnt_off00024336.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24336 6612 bytes
SHA-256: bbfd9d66b540b272ca0353b86b50799dbd9efc1cabdf4e30db392b4be258f497
font_02_sfnt_off000254e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x254E5 11352 bytes
SHA-256: 422cbd0ce2fd87f1b26892ad63ffc843527abe722b6b4fbb1d679434c4224c0f
font_03_sfnt_off00027ae4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27AE4 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.