Malicious PDF — malware analysis report

Static analysis result for SHA-256 c68e8b4edcc0f533…

MALICIOUS

PDF

83.6 KB Created: 2021-04-03 12:55:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: d7e5c700c3211cd349a76907539426b2 SHA-1: c7d98437fc3d5691ec44b1602d76114780e28ac0 SHA-256: c68e8b4edcc0f53378c2c688360ad935f80da1210e0e20dd504daf50157ae8df
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=biomega+manga+reddit PDF link annotation
    • http://jawazapefaxuzit.mywebcommunity.org/abstract_nouns_crossword.pdfIn PDF document text
    • http://lukiduxipapep.mywebcommunity.org/10242204210.pdfIn PDF document text
    • http://xamoxipuwizutux.scienceontheweb.net/letimuwutorosazep.pdfIn PDF document text
    • http://vibijinit.scienceontheweb.net/the_economist_november_10_2020.pdfIn PDF document text
    • http://zumufufup.sportsontheweb.net/tratamiento_psicologico_anorexia_nerviosa.pdfIn PDF document text
    • http://bukuxojunuz.mypressonline.com/princeton_review_cracking_the_act.pdfIn PDF document text
    • http://siluvuxifebul.medianewsonline.com/sintomas_de_ansiedad_generalizada.pdfIn PDF document text
    • http://kutejovanog.getenjoyment.net/xepijanes.pdfIn PDF document text
    • http://kinerexasuxemo.getenjoyment.net/suwasimeno.pdfIn PDF document text
    • http://luziniwanemek.sportsontheweb.net/high_voltage_transformer_testing.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://2a984544-7cb8-4a4d-9f60-e686f7994e39.filesusr.com/ugd/1434d3_7ce13403393b44609b50279ca3109bc6.pdf?index=trueIn PDF document text
    • https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_e9d2e5574b0649a298ad05812c8a6256.pdf?index=trueIn PDF document text
    • https://788ae96d-7a4f-4726-91a9-07bb742fb3e7.filesusr.com/ugd/97aff7_9bf913e21a134d8f81f8dabe7aea9add.pdf?index=trueIn PDF document text
    • https://af1bea64-f5cd-41c2-a7c1-97f21c1aa057.filesusr.com/ugd/592671_e0e9a87d6ece4e9a92c6a6d8035e60c0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lorerexeg/petoderolel.pdfIn PDF document text
    • https://b1e6e3cd-24a2-426a-8b7d-e8f4bd81915b.filesusr.com/ugd/83e584_7911f23bac5d4149a206447c37d0afdf.pdf?index=trueIn PDF document text
    • https://4779f2f8-a33e-4327-9c78-21ee0bcf4620.filesusr.com/ugd/31bf02_c65b0ee9297843ceba787ef87b09713a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kudufigunabi/best_front_load_washer_dryer_combo_2020.pdfIn PDF document text
    • http://fararisujis.myartsonline.com/42089200451.pdfIn PDF document text
    • http://guriseb.myartsonline.com/different_types_of_discourse_analysis.pdfIn PDF document text
    • https://55963656-6eb1-4b25-bcd5-bb835d65808b.filesusr.com/ugd/0064ae_957999d8c1974edeab52757644e388cb.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107F0 4984 bytes
SHA-256: 8e515296b6a3f9b3436be936ba15bd62114c502af7e7a54bb4775bccee4ed962
font_01_sfnt_off000118c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118C8 11888 bytes
SHA-256: 2a739a3f09a249a228f0d59dcdf82732e30f2068a89fdb8e96f5052a0ca4ca6f

Open this report in the interactive analyzer, or submit your own file for analysis.