Malicious PDF — malware analysis report

Static analysis result for SHA-256 d397f7090754502d…

MALICIOUS

PDF

141.9 KB Created: 2021-03-18 19:52:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 76aa6d257b12e2b347f53c826667c34c SHA-1: 10f0bc9237f9bf753762e2358522f2f215f6eac6 SHA-256: d397f7090754502de3e7e43d30f4494cae09a4270d4839799d4514ec73b34131
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=meaning+of+biblical+names+pdf PDF link annotation
    • http://pet-guru.shop/7194542921dttfo.pdfIn PDF document text
    • http://itprod.space/insert_service_roblox384qj.pdfIn PDF document text
    • http://theandyhong.com/bejusupu26lvh.pdfIn PDF document text
    • http://legko.travel/capacitor_value_chart6ya5k.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://aa4de0c4-a7fb-47f6-97fe-5721705e71c1.filesusr.com/ugd/824332_8aebcf76bf49443e9351aabe0190d460.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tarajix/1866627842.pdfIn PDF document text
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_8818692f7f2d4ebaaf1a0fffd6f8fbec.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fuwenoxuzasila/pikosenenabawugezulon.pdfIn PDF document text
    • https://cda84be5-0c54-4c05-8389-97bb004c798d.filesusr.com/ugd/fa9f00_fd44055723db42ca93b513aacbe33443.pdf?index=trueIn PDF document text
    • https://adc67df4-9ac4-4169-8225-f8d60376216a.filesusr.com/ugd/a1c2c7_28879addeda345338349f6e4011099c3.pdf?index=trueIn PDF document text
    • https://f7f2eb1f-4ce6-40bf-b337-6bcc2c9c1a95.filesusr.com/ugd/dc6899_4daf4f9f7bb34b7a9fb4a78c50a6f58d.pdf?index=trueIn PDF document text
    • https://0ca3454e-05ac-49fc-8d00-644b1af7be3c.filesusr.com/ugd/8bf3fc_8b8aaf4dc1384d2e875c402cfc23766d.pdf?index=trueIn PDF document text
    • https://ce3a146a-d504-4efb-981c-4593fb85d965.filesusr.com/ugd/5b5da7_c02838c5589f4919b4dede0e20675bb7.pdf?index=trueIn PDF document text
    • https://4d75d3c9-3a4d-4df6-84ab-e48b83d723e5.filesusr.com/ugd/cdb50c_f9c1b51063db4709bcde6741f3502ed2.pdf?index=trueIn PDF document text
    • https://c1cb471f-fc5c-4ef2-b3e1-4d0d0d09d135.filesusr.com/ugd/cc5b41_5a13810bb6574405b3560f204c7ea355.pdf?index=trueIn PDF document text
    • https://36622f5a-5a1b-41a5-aa98-965156e47ac2.filesusr.com/ugd/804ff6_bc7530171c324d1bb1df6e1a72b21168.pdf?index=trueIn PDF document text
    • https://3c199e1c-ff83-4553-a351-db1e9419129c.filesusr.com/ugd/424a74_5986639bbabb48a2b94b1884730b5e12.pdf?index=trueIn PDF document text
    • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_a848df3237994db8acd7eb3fe5bca825.pdf?index=trueIn PDF document text
    • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_8b253122db6c4d91bef882f39637a41e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/liguwubore/epistaxis_2018.pdfIn PDF document text
    • https://fdb0147f-387d-4908-9c93-1ccdb5bf775f.filesusr.com/ugd/aea2e0_99b6e50dfc4b47fb9e65670614ea2508.pdf?index=trueIn PDF document text
    • https://c931c956-7f53-4e4e-96dc-27d7f003ba63.filesusr.com/ugd/b80c10_d137932e897f4a1e9b443b92cdafcddf.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sasufufa/rovilixemiv.pdfIn PDF document text
    • https://0f8fedcd-12c0-4678-86f8-e2bff7269121.filesusr.com/ugd/70e7d4_6b41e0fe96eb4dbca5bf59bad633904e.pdf?index=trueIn PDF document text
    • https://810dce77-56ab-4324-823a-3549757f4eab.filesusr.com/ugd/1fad07_eb849537476041dc9db79c9223f0ba9a.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d483.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D483 5524 bytes
SHA-256: f686f8a4654b1313dce519346e9764f77fc1409c29ca8f267cd66ab48e8b4d32
font_01_sfnt_off0001e74b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E74B 23876 bytes
SHA-256: 93237364279a5d234986654c8996bcb84f5b55f92902c8006dd97863656192c9

Open this report in the interactive analyzer, or submit your own file for analysis.