Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc138c7d1776af82…

MALICIOUS

PDF

80.4 KB Created: 2021-03-28 15:55:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-01
MD5: 9015f414b4066ae5299ab893f547f198 SHA-1: 8020c8eabdfd08bb9402bd2ec76c431a7f693f2f SHA-256: cc138c7d1776af82b245d25deb3e2fd108e347175241437593ff0f49651c494c
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=swot+analysis+report+pdf PDF link annotation
    • https://cdn.sqhk.co/xarozowuzosa/fKigjbG/off-_road_russian_truck_driving_simulator.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377102/normal_5fee67f366b73.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403820/normal_602789a3112ff.pdfIn PDF document text
    • http://tewazezila.66ghz.com/android_actionbardrawertoggle_change.pdfIn PDF document text
    • http://opensoda.pro/gajoxasazotopifuajrg8.pdfIn PDF document text
    • http://cocobeautybar.ca/901748286679jdbm.pdfIn PDF document text
    • http://punegasu.22web.org/list_of_transition_words_in_spanish.pdfIn PDF document text
    • http://gumovuf.22web.org/taxinexejo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385647/normal_6058dc34395bc.pdfIn PDF document text
    • http://capridigi.com/xesinari4r8y6.pdfIn PDF document text
    • https://cdn.sqhk.co/razefudixid/YoFhcKg/syberia_3_xbox_one_bugs.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dogamesesokuj.rf.gd/ashp_guidelines_on_adverse_drug_reaction_monitoring_and_reporting.pdfIn PDF document text
    • https://fd7a53fe-11c1-4e60-83ad-ac1bb997268f.filesusr.com/ugd/5cf23b_86a7ff2173734b81a9a563543e7d149e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/daselex/38680866781.pdfIn PDF document text
    • https://s3.amazonaws.com/zulezov/boluvawo.pdfIn PDF document text
    • https://4a31e3f8-49e3-4331-b1a9-c0bb7a6b9dbc.filesusr.com/ugd/599f1c_0cf52a486c1148e599af9d4ed37a38c4.pdf?index=trueIn PDF document text
    • https://f3b8d348-8566-49c9-a9f8-a2c3b9e1bc8e.filesusr.com/ugd/f1c748_d442f0a3d9b84a0cb175d65179462452.pdf?index=trueIn PDF document text
    • http://vitorozakosi.rf.gd/vamalegalazaresuvux.pdfIn PDF document text
    • https://s3.amazonaws.com/dutuzanob/28262965508.pdfIn PDF document text
    • https://s3.amazonaws.com/samopakamefap/haunted_movie_ringtone.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000112c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112C5 5332 bytes
SHA-256: 8ebaa67722ebb5cc26921921c771c37df175abf1275e68cb43554405325fb497