Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1a7273a8aeab777…

MALICIOUS

PDF

80.6 KB Created: 2021-03-28 01:10:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: fc7649051209f65b24fbfb0a43eccab0 SHA-1: 490586ba1d0265b44611e8aa9245fa460b57d79c SHA-256: c1a7273a8aeab777f40a708753b09d1f11c7af859a1492e03289d354458711b0
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to disposable hosting, and one directly to a suspicious domain ('mezovuduw.ru') that is likely part of a link farm or SEO poisoning scheme. ClamAV and ML classifiers strongly indicate malicious content, specifically a phishing or trojan distribution attempt. The document body, though heavily obfuscated, appears to contain keywords related to a book title, suggesting a lure to disguise the malicious intent of redirecting users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=capitalism+socialism+and+democracy+pdf+schumpeter PDF link annotation
    • http://nuwazomesesanok.mygamesonline.org/upsc_calendar_2020_21_download.pdfIn PDF document text
    • https://roxomikanu.weebly.com/uploads/1/3/0/8/130873860/2040048.pdfIn PDF document text
    • http://torixobo.mypressonline.com/cazadores_de_microbios_resumen_por_capitulos.pdfIn PDF document text
    • http://birebap.scienceontheweb.net/target_audience_definition.pdfIn PDF document text
    • https://rixexumig.weebly.com/uploads/1/3/2/6/132681576/8008948.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://931f52e6-cb68-4a93-8e02-54808d33f8b6.filesusr.com/ugd/6290de_b2172a5d527744648bd340edef89b367.pdf?index=trueIn PDF document text
    • https://835a0401-7144-467e-aacc-710587930ffc.filesusr.com/ugd/432cba_0e1e636b5d4f4c069b6ecd7ef59919ec.pdf?index=trueIn PDF document text
    • https://98771922-91e4-4673-aa0d-7794f4435593.filesusr.com/ugd/b6aaa0_ed4fc982f3f242e6b98fc7f1041faa17.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/48405773-368f-46c7-86cc-d11fb01da56f/tipos_de_fichas.pdfIn PDF document text
    • https://8c1dc56a-a131-4b43-acff-3635b9115217.filesusr.com/ugd/90423f_2c82127ef7b442bfbd6949d57e666a98.pdf?index=trueIn PDF document text
    • https://6d8b2927-5c4d-40df-b593-c6bd35e19528.filesusr.com/ugd/1adac8_f15e46bfad9744458daa020ac8173370.pdf?index=trueIn PDF document text
    • https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_849d4686246449bf86360f1c79a25de4.pdf?index=trueIn PDF document text
    • https://26b54b0d-7067-4615-bd5a-e9f638bc9197.filesusr.com/ugd/26f5b5_8ab883155d0e42f486a93c9ff7035693.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/27247f38-dd88-4f97-a28f-c28146727059/35947573112.pdfIn PDF document text
    • https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_8fb4cef064b448869d8b492b94bcc40d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/008156b0-8a39-4c39-857c-1062dccbabe6/black_and_decker_smart_battery_charger_2_10_15_manual.pdfIn PDF document text
    • https://6bfd3344-23d3-4e03-ab7d-00c1c23eecf6.filesusr.com/ugd/be19e1_0ae517ecd50c4fe59393931cb9428f20.pdf?index=trueIn PDF document text
    • https://8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com/ugd/b2ba6b_b0a881097e6844be90d025f858280e0f.pdf?index=trueIn PDF document text
    • https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_5129fc36c6d64e03a453c415b5455a42.pdf?index=trueIn PDF document text
    • https://e5eb5b25-b33c-43e3-82d5-57ab1bf863d8.filesusr.com/ugd/b0c717_d8074f2a1c5a4db794f208857a6cde93.pdf?index=trueIn PDF document text
    • https://6cda4dd4-8aac-43e7-8003-7c0eea9f7907.filesusr.com/ugd/34e26e_7bad13b60d6d471f98b9de25a753736c.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eef7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEF7 5404 bytes
SHA-256: f63a7fd1d9cf83ebe1cfd226b9325f553b7e6ce45ec93f371efa69b3d43a56f3
font_01_sfnt_off00010130.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10130 10376 bytes
SHA-256: f9e51083ecbdf99c6c14630169bfd0ee8f272726dfc7280e3118a01aa0b5c143
font_02_sfnt_off000124ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124AD 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.