Malicious PDF — malware analysis report

Static analysis result for SHA-256 da1529353a671687…

MALICIOUS

PDF

79.3 KB Created: 2021-04-11 13:07:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 601b59c2867e2bd47259436ace0c99b8 SHA-1: 7031f5e40458d60afe3a0cd2232ad17b11610252 SHA-256: da1529353a671687fc531dd202c1c00688b8efb153dd603b5b0e9bf3fc935f58
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical finding for linking to known malicious redirector infrastructure. The document contains a large number of embedded URLs, many hosted on disposable domains, suggesting it is part of a link farm or phishing campaign designed to redirect users to malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/strik?utm_term=neato+robotics+neato+botvac+d+series+spiral+blade+brush In PDF document text
    • https://ramabubutimelu.weebly.com/uploads/1/3/4/5/134597411/b1eddd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418778/normal_602256a86f291.pdfIn PDF document text
    • https://vegujuzemev.weebly.com/uploads/1/3/4/0/134017506/gexixanawurilirudamu.pdfIn PDF document text
    • https://gibuzilo.weebly.com/uploads/1/3/4/6/134602166/zarakoz-kibinij.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452389/normal_603d0fb0cb3cb.pdfIn PDF document text
    • https://sovakevu.weebly.com/uploads/1/3/4/3/134341498/7023595.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414501/normal_606e0914971de.pdfIn PDF document text
    • https://wetugaremuzen.weebly.com/uploads/1/3/5/2/135298520/46b66ff6adfd1b.pdfIn PDF document text
    • https://wigubidukes.weebly.com/uploads/1/3/1/6/131606651/c5a5bfd29a4d2.pdfIn PDF document text
    • https://vowinerini.weebly.com/uploads/1/3/4/3/134385114/7898117.pdfIn PDF document text
    • https://jokilexagazoxo.weebly.com/uploads/1/3/4/6/134602179/a2efe44d2fabc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481154/normal_6009d5465c6ed.pdfIn PDF document text
    • https://fajevubesupuvax.weebly.com/uploads/1/3/5/3/135387480/ea3dba3fd9.pdfIn PDF document text
    • https://fipamowusaki.weebly.com/uploads/1/3/4/8/134879766/3301116.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/90f47c32-8cac-4ee5-8e08-33d2415183d9/the_raven_edgar_allan_poe_summary_sparknotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ef97570-5626-419e-92c4-988efef25e55/when_a_man_is_interested_in_you_quotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad8e17a8-59c2-45b4-86f9-cfffaac16388/sewararukuxabuwun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/713132e1-59f0-4cdb-a0be-0aea3e61e8fa/81123448236.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0aca3f97-af4e-47e4-bf20-8cd14c694341/boston_market_mac_and_cheese_price.pdfIn PDF document text
    • https://36535336-4f9e-4c0a-b1ad-3385cb5d4299.filesusr.com/ugd/15ebe2_ed23199e6309446784c8ab377dd087dc.pdf?index=trueIn PDF document text
    • https://b5bf9d6c-20c1-49b5-85fe-623de7fa9aef.filesusr.com/ugd/e745be_b151df068ffb48f4bf437f217475986b.pdf?index=trueIn PDF document text
    • https://ec560393-4650-4708-bf0c-d08fceb8458c.filesusr.com/ugd/ca69db_46ab418ba6a64402b97e4cd043e5cd37.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/285bf3df-9186-4a3a-bc32-57b848f44b2d/what_are_spanish_possessive_adjectives.pdfIn PDF document text
    • https://7ec9ed57-df89-401a-953b-45744c150cee.filesusr.com/ugd/6e3131_347aa92088a94d64922c1a5c644baeb4.pdf?index=trueIn PDF document text
    • https://a9b7993f-6967-48c1-a2c3-d5bc86fe985f.filesusr.com/ugd/ea2be3_219ec19df333492c9ca95de17faf5732.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f460.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF460 5332 bytes
SHA-256: 965b353df0c37c884d7dd8d6201d26755c78341a23f329649361e0d78bb36fbe
font_01_sfnt_off0001067a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1067A 11800 bytes
SHA-256: a76fbe96b921534b7f54bba9aea759459d9b9c3b0d7d622a704bc6cdd67812cc

Open this report in the interactive analyzer, or submit your own file for analysis.