Malicious PDF — malware analysis report

Static analysis result for SHA-256 c26d6132e7bb5212…

MALICIOUS

PDF

94.0 KB Created: 2021-06-02 22:26:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e6833f6cd20f1ea8cdf67fc130cc370d SHA-1: 3fab4fe426f01f8dc94c3ceb9e52e036d740f48c SHA-256: c26d6132e7bb52126647de2adf7724a261d492aa376412fce27c5f3b06178122
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO spamming tactic. The ClamAV detection indicates it is a known phishing or trojan variant. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4757

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/pbw?utm_term=tere+baare+mein+na+sochu+mp3+song+download+djpunjab
    • https://xitawameduzip.weebly.com/uploads/1/3/4/5/134511141/kujed.pdf
    • https://rerijore.weebly.com/uploads/1/3/1/8/131856643/kakuzukux.pdf
    • https://nifadajenekipib.weebly.com/uploads/1/3/4/3/134305148/9a1d77c0aeff7.pdf
    • https://motutipe.weebly.com/uploads/1/3/4/6/134674000/busetuzofejelir_welegobivajosek.pdf
    • https://zokijirimabijim.weebly.com/uploads/1/3/5/9/135964806/3033975.pdf
    • https://gibejuta.weebly.com/uploads/1/3/0/7/130776113/5ec9d7.pdf
    • https://xamonato.weebly.com/uploads/1/3/2/8/132814301/bc6f44929f2a6f.pdf
    • https://panulozeti.weebly.com/uploads/1/3/5/3/135351273/navudodexavejo.pdf
    • https://xasamaxubema.weebly.com/uploads/1/3/5/3/135387487/rizelemu_fexejado_wifanas.pdf
    • https://jikevisanudopud.weebly.com/uploads/1/3/4/0/134017539/915dabfcbd2e.pdf
    • https://kazarebowuw.weebly.com/uploads/1/3/5/9/135972211/2646727.pdf
    • https://xeluluferira.weebly.com/uploads/1/3/4/2/134266649/27575.pdf
    • https://besunuvoduzusub.weebly.com/uploads/1/3/4/2/134266379/4610305.pdf
    • https://mitexasax.weebly.com/uploads/1/3/1/8/131857270/kejajizezuwi-jidenaki.pdf
    • https://ropejanetim.weebly.com/uploads/1/3/4/6/134600341/e323b598682c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tusoxefum.pbworks.com/f/lifan_125cc_engine_repair_manual.pdf
    • http://funuvutidip.pbworks.com/w/file/fetch/144458586/23985769153.pdf
    • http://gitefov.pbworks.com/f/vafobebogigoposulik.pdf
    • http://nugewus.pbworks.com/f/20451103223.pdf
    • https://uploads.strikinglycdn.com/files/e669f019-aaab-41e7-b655-350f8c0f5bd1/lofafopomavudokifov.pdf
    • http://xovakovawup.pbworks.com/w/file/fetch/144487206/gta_san_andreas_game_download_for_windows_10_64_bit.pdf
    • http://wuvebag.pbworks.com/w/file/fetch/144428604/modern_biology_textbook_standardized_test_preparation_answers.pdf
    • https://uploads.strikinglycdn.com/files/187abcd3-a195-4993-97b8-c54840bbb6c2/la_metamorfosis_de_una_mariposa_para_nios.pdf
    • https://uploads.strikinglycdn.com/files/e58b1a46-f307-4c43-aee8-2d3f0e4b58f2/14307078708.pdf
    • https://uploads.strikinglycdn.com/files/1d66d3bd-f649-484f-8b97-a5dcc91635b5/kilajexo.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000137a9.bin
da22cb474d64774b1f81378d63fe5cb4425691ce54f7e59e7ddd219b36ce71e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x137A9 5908 bytes
font_01_sfnt_off00014ba8.bin
cd27882af74979450f65ff7d6b12a0fa6748de7d48bd00d6647516675c1d8365		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14BA8 12164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.