Malicious PDF — malware analysis report

Static analysis result for SHA-256 caf4e929c366bf6b…

MALICIOUS

PDF

63.5 KB Created: 2021-03-23 10:43:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b1d08eae455a2895e76e8965c069a3ee SHA-1: b050f3f285bf640b7ade7b19b01b0facd7981d2a SHA-256: caf4e929c366bf6b372fed787a0cded6a556c0a098379c0572303512f0df06b1
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious intent. It functions as a link farm, directing users to numerous external URLs, one of which is a known malicious domain. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of embedded URLs points towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9829

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=a+few+of+my+favorite+things+sound+of+music+lyrics
    • http://bitagaratela.22web.org/gomegatuxiwuwox.pdf
    • http://egrn-order.online/175182884894pw5a.pdf
    • https://static.s123-cdn-static.com/uploads/4486563/normal_5fdf948a8c819.pdf
    • http://sunny-web.ru/bodies_that_matter_quotesfz33y.pdf
    • https://cdn-cms.f-static.net/uploads/4413238/normal_603f85208e0f8.pdf
    • http://kufafukedexepix.mygamesonline.org/bofakojikeloziwelufe.pdf
    • https://cdn-cms.f-static.net/uploads/4412891/normal_5fd9316df1e1a.pdf
    • http://nekimul.22web.org/how_to_watch_star_wars_canon_in_order.pdf
    • https://pejegenipejixe.weebly.com/uploads/1/3/4/8/134848799/vozad.pdf
    • http://smartcoin.design/samsung_js8500_hdr_updatesfg7x.pdf
    • https://letitunonagafi.weebly.com/uploads/1/3/4/4/134494227/b6efa2f8.pdf
    • http://rezotu.xyz/5924856172493e6g.pdf
    • http://mitisavad.getenjoyment.net/used_line_6_spider_iv_15w_1x8_guitar_combo_amp.pdf
    • http://esagafow.fun/benobolokotaxoxesckgt.pdf
    • https://cdn-cms.f-static.net/uploads/4382973/normal_5fd61218abfd1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://namakanexir.atwebpages.com/79390849947.pdf
    • http://muvipifipu.rf.gd/what_is_the_loudest_roblox_id_2020.pdf
    • http://nepafel.epizy.com/bern_switzerland_map.pdf
    • http://bividit.rf.gd/total_war_warhammer_1_bretonnia_guide.pdf
    • http://rapodebo.epizy.com/bumigumemivametogewirafop.pdf
    • http://kadoxosin.atwebpages.com/english_phonetics_and_phonology_peter_roach_free_download.pdf
    • http://nemusif.rf.gd/wugaletojaba.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c963.bin
ad12a8124a78c74d1f64595cdd727b1db2e0c20f5c581e040c991160b1aeb9a5
pdf-font-stream PDF embedded font (sfnt) at offset 0xC963 5676 bytes
font_01_sfnt_off0000dca6.bin
9c5a9ff9574e01609d23e420c77456013724a7740eb3e02f4b6eac941506cacf
pdf-font-stream PDF embedded font (sfnt) at offset 0xDCA6 9896 bytes