Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1d5703adc236ffa…

MALICIOUS

PDF

78.9 KB Created: 2021-06-04 07:55:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c540aec729668c14800b6f4aef85bc25 SHA-1: b4a3c4d40f38a7999e9bd3d61553cf9c8d506a07 SHA-256: c1d5703adc236ffa4380a03c0dc83db79ac1610df8aff41e76e90640ae610b1e
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO manipulation tactic. ClamAV detected this file as Pdf.Phishing.Trojan, and ML classifiers also flagged it as malicious. The embedded URLs suggest a phishing or content distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7680

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=the+lais+of+marie+de+france+pdf+penguin
    • https://zanirifut.weebly.com/uploads/1/3/1/4/131407922/wawinoj.pdf
    • https://fejomuzuzozasas.weebly.com/uploads/1/3/4/7/134748710/9003549.pdf
    • https://cdn-cms.f-static.net/uploads/4369768/normal_6020b9cd9f73b.pdf
    • https://xipididida.weebly.com/uploads/1/3/4/6/134698194/roferubebakazut.pdf
    • https://lasogevedona.weebly.com/uploads/1/3/1/3/131398076/0901b4d7f.pdf
    • https://static.s123-cdn-static.com/uploads/4455198/normal_600603e6ae3b7.pdf
    • https://mosofekux.weebly.com/uploads/1/3/1/4/131437457/3029768.pdf
    • https://tolonatapuxid.weebly.com/uploads/1/3/4/0/134042297/cd7c7a2fcc217.pdf
    • https://fepobewute.weebly.com/uploads/1/3/5/3/135386667/pejogiso.pdf
    • https://cdn-cms.f-static.net/uploads/4421629/normal_601e9201c62db.pdf
    • https://cdn-cms.f-static.net/uploads/4424011/normal_60523f04f1526.pdf
    • https://cdn-cms.f-static.net/uploads/4502870/normal_6067cb521d0a8.pdf
    • https://movibudepusoxof.weebly.com/uploads/1/3/4/6/134636867/jilejetu.pdf
    • https://cdn-cms.f-static.net/uploads/4428054/normal_600c49db4466a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4f607273-47b9-41ec-b6bd-04144da760e1/xitalobaroze.pdf
    • http://xutosop.pbworks.com/f/recrystallization_of_aspirin_lab_report.pdf
    • https://uploads.strikinglycdn.com/files/c6e34db1-c9b8-4723-8e19-b8abffa7a1a6/le_petit_prince_movie_vs_book.pdf
    • https://uploads.strikinglycdn.com/files/69384488-385a-4245-8f83-d339a3be8d47/how_many_watts_to_charge_milwaukee_18v_charger_use.pdf
    • https://uploads.strikinglycdn.com/files/bea455b1-7b57-434d-9006-4bf6f3c7152a/18056855327.pdf
    • http://lekuzax.pbworks.com/w/file/fetch/144411894/gubusugaje.pdf
    • http://xodelow.pbworks.com/f/fishing_clash_hack_no_survey.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010581.bin
e7e17810f5fb255904a98c2e10a1ae18d6e7ae1ed4bb2933d2ed0b6eb7464db8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10581 5516 bytes
font_01_sfnt_off00011817.bin
7a48273665d2552f5fc055eb2ab3b3024436f005b89dea49241d35627cd81a6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11817 12812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.