Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca967853f443a87e…

MALICIOUS

PDF

129.4 KB Created: 2021-06-04 21:58:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 716442f518f811e94c8193d24709d2c8 SHA-1: 7c0f711e8f1e82a77a705dbe8a7b9a07f4aff54b SHA-256: ca967853f443a87e0b4d2551213b7e0b92ba615917ecc2726b2e8452ca441597
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF was flagged by ClamAV as Pdf.Phishing.Trojan and an ML classifier indicated a high probability of maliciousness. Heuristics identified it as a link farm containing numerous external links, many hosted on disposable domains. The document body contains garbled text and metadata indicating it was generated by wkhtmltopdf, suggesting it's not intended for direct user interaction but rather as a container for links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9848

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/pbw?utm_term=sawarasenai+kimi+wa+shojo+na+no+lyrics+translation PDF link annotation
    • https://lifulufo.weebly.com/uploads/1/3/1/3/131379971/naxunata_sesasex_dovojup.pdfIn PDF document text
    • https://kexeretuzigu.weebly.com/uploads/1/3/1/6/131637303/dumimowetatofe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468286/normal_60644616ac189.pdfIn PDF document text
    • https://tevoletefe.weebly.com/uploads/1/3/1/6/131606261/8e1a0447.pdfIn PDF document text
    • https://kapokifi.weebly.com/uploads/1/3/4/5/134510442/7774975.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501057/normal_5fdd9c53b73f0.pdfIn PDF document text
    • https://pubigomusukuma.weebly.com/uploads/1/3/4/5/134511275/xupepan.pdfIn PDF document text
    • https://vixezikuf.weebly.com/uploads/1/3/1/3/131383943/bimaxi.pdfIn PDF document text
    • https://gujexewemozi.weebly.com/uploads/1/3/1/8/131856271/notifivoxujeb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375195/normal_6057a61a5545f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://uploads.strikinglycdn.com/files/8bbe55c4-e789-46e7-87cb-49eef977ef54/duxapowibixewedaxeb.pdfIn PDF document text
    • http://letonepamusi.pbworks.com/w/file/fetch/144466767/turiravadozakuzozufira.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a192cf1-5375-4fcd-9b3b-aa192ef9bc2e/zoom_g1_on_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6b4f4df-a1f7-407f-8d1a-4112ee47f671/software_development_engineer_amazon_interview.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbe67006-1bf2-47ef-9bf5-552ca97cd9c3/how_to_program_a_xfinity_remote_to_a_panasonic_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4a35ac6-aec9-4995-9566-d22e3e958535/arduino_kits_for_students.pdfIn PDF document text
    • http://kokoxudalux.pbworks.com/f/descargar_winrar_para_windows_7_32_bits_gratis_espaol.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001208f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1208F 6588 bytes
SHA-256: fa72874b8c381873b432d3b5cea9ecddba20f04e8e1c9face7d560df1136061a
font_01_sfnt_off000130d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130D9 10276 bytes
SHA-256: 123d51656c372dde11d2e24250d2de626b8a7222d65060a58599b4b4e1ee4ca5
font_02_sfnt_off000153a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x153A3 5476 bytes
SHA-256: c35a4005b7a2e4c0e5bc9d1f15d4adc1cabd41979f607fa60984391e17e1b95e
font_03_sfnt_off0001662e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1662E 10972 bytes
SHA-256: 66ad6582e5f499fd1976278d9d05b6b8a28fe88e398ad6c0b2339e596b51b23e
font_04_sfnt_off00018967.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18967 8120 bytes
SHA-256: d3a8b25d11b27980e81514b1d2a433f9ac630f1b7dc3b45b61729c559e488ad0
font_05_sfnt_off00019fd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19FD3 14848 bytes
SHA-256: 83889f151fe33d0d8cb24928c56652866b1f683d6772a1487eb98e73a6d2292d
font_06_sfnt_off0001cc1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CC1A 19960 bytes
SHA-256: ab9d99b88638d483b1b1cc120fd117f9d82869ad850538f88cfd9bcd2ab27ca5
font_07_sfnt_off0001ec37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EC37 1736 bytes
SHA-256: 551918360585b1590efa6fd2a215345b2f702067d151a0e4b48cfa7490b57960

Open this report in the interactive analyzer, or submit your own file for analysis.