Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1bc15ad671840d3…

MALICIOUS

PDF

76.7 KB Created: 2021-03-08 07:44:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 9218d5d55cd255b86d74dd112f12eef7 SHA-1: a382f5aff4f4e903c133701652635e4d9a385a74 SHA-256: c1bc15ad671840d37cc16cf8cdf4e9ffa37b1e455daf4e4abbd6b49bfdba7440
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier. It contains a significant number of external links, many pointing to disposable domains, indicative of a link farm or phishing campaign. The presence of 'utm_term=how+to+cross+the+river+styx' suggests a lure, potentially related to a scam or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=how+to+cross+the+river+styx PDF link annotation
    • http://naturwow.space/749920437216w6fo.pdfIn PDF document text
    • http://kemytbok.xyz/jackson_json_tutorialyfzee.pdfIn PDF document text
    • http://com-copyrighit.com/83837908354lxarw.pdfIn PDF document text
    • http://skout.tech/wallpaper_photo_break_upqfxk5.pdfIn PDF document text
    • http://sawawobutexukut.iblogger.org/69287712708.pdfIn PDF document text
    • http://wownatural.fun/drivers_manual_californiahnl53.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://68a74d12-89ac-4a94-b826-09ad332a30bf.filesusr.com/ugd/1a0392_6aaf11279b9e457cbbe99b542bd00f74.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/58db0893-5e92-4098-b717-0ed67e37383d/uma_breve_histria_do_brasil_download.pdfIn PDF document text
    • https://d96c97ce-d560-475e-b121-ba86daca0e7c.filesusr.com/ugd/599026_05593a0f6cef49f2af1afcfc3a9e1757.pdf?index=trueIn PDF document text
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_843f3fbfaee640a08a0147a454a6610a.pdf?index=trueIn PDF document text
    • https://18cb0a1d-3822-48a5-9ca0-56465202bc9b.filesusr.com/ugd/96564c_581a0e34ad6a4de0be94a9f8e578bb88.pdf?index=trueIn PDF document text
    • https://f2d828cf-06d9-46ea-85af-d88b0bc20d44.filesusr.com/ugd/501a20_9ebb874ef83f4f0ab63e6deb1acc4ffa.pdf?index=trueIn PDF document text
    • http://xetixeguxiji.epizy.com/l_histoire_du_cambodge.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8da85bc8-d8db-453c-8d1c-1466a90267e4/cultural_anthropology_case_studies.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5017744a-11dc-496a-8497-6ae21f36ae11/peripheral_brain_for_the_pharmacist_2018-19.pdfIn PDF document text
    • https://11be7779-5615-4adc-aeb2-17624735b21e.filesusr.com/ugd/b0b521_0c2e905e529a4becb230b0c93e697662.pdf?index=trueIn PDF document text
    • https://8e8ef6ac-913c-489f-8395-c30730e7ba0a.filesusr.com/ugd/f39c52_fb66a26fe699488d922f0029fc6d06e1.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b495f48f-24f4-4d6a-8c09-e771700f977a/85309897403.pdfIn PDF document text
    • https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_3210db0ee6734bceb10821f216082813.pdf?index=trueIn PDF document text
    • https://8d59741e-369e-44be-b01e-8fbcb09d2d01.filesusr.com/ugd/7cefa9_21fcdc6994a04d06aff09ab804e1b82e.pdf?index=trueIn PDF document text
    • https://cd70d4e5-4a1a-4071-96d1-f2415ea5ece1.filesusr.com/ugd/7f46b5_df298f80f1fc474fb524dba378521b18.pdf?index=trueIn PDF document text
    • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_150849ea9c6e45f4b3bda897c1cd2d4a.pdf?index=trueIn PDF document text
    • https://eff7b67d-fef5-45b7-bcd6-ffb1b71d3a14.filesusr.com/ugd/b4c9df_6398ef82d66144f48dacae94a480681a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c3e276e-20ff-444d-a497-3229efefb362/4th_grade_math_assessment_with_answer_key.pdfIn PDF document text
    • https://b54663a3-ff9d-4122-b75c-69b71428c9b0.filesusr.com/ugd/cfa91a_7fcbc65db50843d3a104acce2a20784c.pdf?index=trueIn PDF document text
    • http://gabatotudam.rf.gd/13217119652.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e954.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE954 4928 bytes
SHA-256: 18da7ef816a5fa39b40aca38abc1ec30422a4904764a30a909c706c286c2f129
font_01_sfnt_off0000fa31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA31 13324 bytes
SHA-256: e626122b8bd3375934ae22cff5692766be7164801ab1d85a294bce22243e85ec

Open this report in the interactive analyzer, or submit your own file for analysis.