Malicious PDF — malware analysis report

Static analysis result for SHA-256 c159ea3710c21e84…

MALICIOUS

PDF

79.9 KB Created: 2021-04-06 18:48:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 5f15f5783b6c4ae275f06c395a2cd339 SHA-1: 018330aae56a4dad1ea368999c49f528e27a67f4 SHA-256: c159ea3710c21e84185f9a33fb70b54de3732846ddfb83cb2496478158983efa
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO manipulation tactic. The primary malicious URL identified is https://midufefew.ru/wix?keyword=prepositional+phrase+adjective+or+adverb+worksheet+with+answers, which is likely used to redirect users to further malicious content or phishing sites. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9957

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=prepositional+phrase+adjective+or+adverb+worksheet+with+answers PDF link annotation
    • https://cdn.sqhk.co/nanubebebot/Pgdhvhg/eurosport_europe_tv_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/dexasubu/hcFKuji/90578017760.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481684/normal_60224486a60b8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450884/normal_5fcdae0f6eaf4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450727/normal_6011022775c32.pdfIn PDF document text
    • https://cdn.sqhk.co/pixazizaze/gdhbtMs/27654038761.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462727/normal_60176b9b06ea3.pdfIn PDF document text
    • https://cdn.sqhk.co/kitujesijak/hijCAia/coin_collection_display_box.pdfIn PDF document text
    • https://cdn.sqhk.co/pinofizulag/9SJijIV/83381372994.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/151160b3-a623-45d3-b457-2fdc8a0e05b3/77120663018.pdfIn PDF document text
    • https://c81c1a69-aec6-471c-ac34-7a6800eafc69.filesusr.com/ugd/9ef1ea_36a835aaac45433b890c4065723c8c7d.pdf?index=trueIn PDF document text
    • https://50b44c92-959e-4a15-bf83-93d6b2b518d6.filesusr.com/ugd/3ed44c_253b0347c1f6433486885aa0ab8b54b4.pdf?index=trueIn PDF document text
    • https://4253c66a-660d-4c83-b31d-f715833d547b.filesusr.com/ugd/d9e9a0_031eb3093c74406f8110b3c469ac613b.pdf?index=trueIn PDF document text
    • https://b01ec662-dec5-4f54-b977-8708717d6054.filesusr.com/ugd/07e02c_e72e27ab73d84c3e805bc9405a01e9c4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/10974fc6-736f-49bd-9b27-c52324f3d627/citizen_mens_promaster_nighthawk_watch.pdfIn PDF document text
    • https://237a2310-9536-43ad-add1-fe73b840a51a.filesusr.com/ugd/8b319d_b82264b3379b4799af94233fdffe198a.pdf?index=trueIn PDF document text
    • https://37e79482-e567-4eff-b449-6ea9b90d4679.filesusr.com/ugd/cff0cd_15fed7503ce44e7f833bd021b66e6aeb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a120c181-8668-42b6-8f79-1c810dd49b3a/mdr_zx330bt_battery_life.pdfIn PDF document text
    • https://5e6d3f51-9b35-4a29-baf4-1f036254a461.filesusr.com/ugd/99a8f2_1b13f33e33c746b19210818d74f0752c.pdf?index=trueIn PDF document text
    • https://a68e2ff5-bf17-48e3-82d4-ceb975b85758.filesusr.com/ugd/760101_179d0e42ae6040f293aded45a4afd323.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/be0dc00e-01ea-4778-95d4-1541955d9645/how_to_survive_being_alone_after_divorce.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a64b24a-0554-44ca-b1b1-db43dd1613c7/14735746046.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce5ee830-ea45-4cba-933f-568dae0f1075/sefer_raziel_hamalach_espaol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82d9b3b9-c2e3-47a6-b9bd-383d3510c516/96462767503.pdfIn PDF document text
    • https://1c896d37-30d1-4b4d-9537-98f963aae812.filesusr.com/ugd/865d50_901d7fa0bd0d4d73891c2f4e2ab24f5d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/391fb2b8-f4e9-461d-bd40-880f67fa468a/how_to_charge_my_jlab_headphones.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2204e37-d2d0-4ae8-b6c3-a3665ca86ae5/wutovawixoxa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f942.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF942 5592 bytes
SHA-256: d590526dbe97aa6621f516d5f0bf32e886b9254cacd92f54db14118e3669677b
font_01_sfnt_off00010c4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C4C 10668 bytes
SHA-256: b342f9e1d4553f7a1b326f5535dd870df50bbdce5237726f08c70f3de97017d7

Open this report in the interactive analyzer, or submit your own file for analysis.