Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4bad647ac4de7f3…

MALICIOUS

PDF

102.1 KB Created: 2021-03-24 02:05:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 31fe20c66d13798afe9833653d0f7def SHA-1: bc34a37ee970a182e2ecabdaacbabe87a97046d8 SHA-256: d4bad647ac4de7f397e0e445af923cc5e0613e187e4f9780362cc1a8516df4ea
196 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used in SEO link farms to disguise malicious URLs. The primary malicious URL, 'https://midufefew.ru/strik?utm_term=toro+timecutter+ss4235+parts+manual', is presented as a lure for a parts manual, but is flagged as a redirector for phishing. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=toro+timecutter+ss4235+parts+manual PDF link annotation
    • http://mugukix.mygamesonline.org/how_to_semiotic_analysis.pdfIn PDF document text
    • http://widuzuduzudovix.iblogger.org/3d_models_free_fbx.pdfIn PDF document text
    • http://zonedelukekide.iblogger.org/desordenes_alimenticios_en_la_adolescencia.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wifukedot/9230533699.pdfIn PDF document text
    • https://s3.amazonaws.com/banula/sizerulutuvidu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/820a7ab0-64f1-4b79-b2a7-b42845819923/divodopiponovavibofan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/deb7bb71-3f92-4386-be41-44f6cc622263/felinemijalokifinotorevix.pdfIn PDF document text
    • https://b1b1ed1d-a631-407f-b8a0-2f609481a9c2.filesusr.com/ugd/3e5895_6de11530141b4be4a4f60a29beaebe1c.pdf?index=trueIn PDF document text
    • http://titugol.atwebpages.com/stealth_cam_stc-qs24ng_instructions.pdfIn PDF document text
    • https://s3.amazonaws.com/zetituri/guia_de_camping_en_espaa.pdfIn PDF document text
    • https://dda5c79a-a75d-44d9-a006-48dec3bfe172.filesusr.com/ugd/115d6e_f90049b851bb4f21b69d9fe7cecd791f.pdf?index=trueIn PDF document text
    • https://1a6c606f-1efd-495f-9370-57f425d809fd.filesusr.com/ugd/1be480_06aae3f6560b4f36863bec8f69aa6d27.pdf?index=trueIn PDF document text
    • http://numakuzugurewi.rf.gd/21313965384.pdfIn PDF document text
    • https://s3.amazonaws.com/wofaxil/test_completion_report_definition.pdfIn PDF document text
    • https://856cb5e6-6c81-45ce-9604-b57907a15cd2.filesusr.com/ugd/cc3ca9_fcacf82174eb40068c4afa0bc3102e18.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a00d93df-9e3e-4c5b-81dc-5628761622ac/24491369306.pdfIn PDF document text
    • https://s3.amazonaws.com/davawina/79810760369.pdfIn PDF document text
    • https://s3.amazonaws.com/fomudebipefasu/16824650264.pdfIn PDF document text
    • https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_2b3ec49eb0a647c3ac3bbec6a9cfd50c.pdf?index=trueIn PDF document text
    • http://ruruwuvatokatal.onlinewebshop.net/gotuk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a224e7b-3e84-4f2f-a900-5ad645feb771/best_international_law_schools_europe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000151b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x151B0 5536 bytes
SHA-256: ac63ba3e36c02cf3fc86898332ab25ac9863aec462ef6c6c646343eb3cda05aa
font_01_sfnt_off0001646f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1646F 10908 bytes
SHA-256: 42502ba6c34b93b47b323f76dfdf347e0770eb9ed7aa1e303b18449f87c748e0

Open this report in the interactive analyzer, or submit your own file for analysis.