Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf35a39b7a5800ec…

MALICIOUS

PDF

111.9 KB Created: 2021-05-06 18:31:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 6be9aafcf91383d10cbf2941943689b9 SHA-1: 4d567bd3d471983211840b59ebb61c9f9ad4ba0d SHA-256: bf35a39b7a5800ecb62426baea6e8958560e92f8076d86a2e78f49c9362b925a
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by multiple heuristics as malicious, including a high-confidence ML classifier and ClamAV detection. It contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain ('gimoguvi.ru') that is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains references to technical diagrams and potentially misleading content, consistent with a lure for malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9440

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=usb+pinout+sata+to+usb+wiring+diagram PDF link annotation
    • http://fetoxuk.mywebcommunity.org/schneider_electric_altistart_48.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490265/normal_5fed9038b0072.pdfIn PDF document text
    • http://legegapepapo.medianewsonline.com/digital_electronics_engineering_notes.pdfIn PDF document text
    • http://ukrinsure.com/piwukedokuzapelupzzyt.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416301/normal_600b23c23d9ba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479462/normal_5fe1c75121fb8.pdfIn PDF document text
    • http://winoorama.space/ditepozozwe3sc.pdfIn PDF document text
    • http://italywow.info/whats_the_healthiest_drink_at_soniclamai.pdfIn PDF document text
    • http://mugedly.xyz/53458594653ivqpy.pdfIn PDF document text
    • http://rowowesofazov.medianewsonline.com/make_smaller_macbook.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406771/normal_60134257b7f9c.pdfIn PDF document text
    • http://ighelperscenter.com/passive_voice_for_all_tenses_rulesn9r8n.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6593eeda-10fe-4128-810f-cbbc79f0a4f8.filesusr.com/ugd/c0a4bf_beccdf70c77e418d98e3f5cedc1fa7d6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jiwisi/calculus_grade_12_notes.pdfIn PDF document text
    • https://s3.amazonaws.com/kigavanus/xavarureb.pdfIn PDF document text
    • https://c6926203-1eb9-401e-9afa-11f61f201807.filesusr.com/ugd/685707_4d267e54bfbf4922921f7daa03448dce.pdf?index=trueIn PDF document text
    • https://656adf98-7a81-40bd-8d0f-2b9c27d09201.filesusr.com/ugd/268ab1_11a88e4ff5b047d084c4339a0b5904e7.pdf?index=trueIn PDF document text
    • https://ad0d0dbb-669b-46a9-85df-79487014a0f3.filesusr.com/ugd/00d95d_8dec7e2b12b540cab298bd510e8b326a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e2080f4-9e81-463c-ae49-851a124d2066/air_fryer_shrimp_recipes_gluten_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7462fa9a-0f22-42a5-aeed-c51c7ed5602b/ssr_125_pit_bike_decals.pdfIn PDF document text
    • https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_ae17377ec2d84e5dbf23745814318a36.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/998b9166-6a38-4860-854a-ddab8c59ddde/bavironuwifapufoxu.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a6c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A6C8 5468 bytes
SHA-256: ccf30c4c5c18c39376e0f306cae55b859f999c0a32e85014a579a355e916cfe8

Open this report in the interactive analyzer, or submit your own file for analysis.