Malicious PDF — malware analysis report

Static analysis result for SHA-256 dadf24eba199a8da…

MALICIOUS

PDF

76.9 KB Created: 2021-04-01 00:11:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: 81dcefe54758faba29f03b01f59cc47a SHA-1: 8dd7a25e7f0ed39edc232524de4dd80445c05b55 SHA-256: dadf24eba199a8da11ac672065b37325e2082c9c3d5039352b2e7f038e403e6d
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a link farm designed to redirect users to potentially harmful websites. The document body, though heavily obfuscated, contains references to software downloads, suggesting a lure for users seeking specific applications. The presence of numerous external URIs, many hosted on disposable domains, further supports the malicious intent of redirecting users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=hungry+shark+apk+2019+android+oyun+club PDF link annotation
    • http://xidotamasaw.22web.org/great_i_am_chords_and_lyrics.pdfIn PDF document text
    • http://megopoveguvujal.medianewsonline.com/maksud_surah_al_mulk.pdfIn PDF document text
    • http://foselosen.sportsontheweb.net/66015718837.pdfIn PDF document text
    • http://rawutunulodewo.iblogger.org/29683652126.pdfIn PDF document text
    • http://javaxirivibewi.mygamesonline.org/how_to_keep_track_of_your_weight_loss.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9eee391a-80f1-4e46-bb57-275ce6b53349/gusotodigejapogawap.pdfIn PDF document text
    • http://kitilogokufalu.atwebpages.com/basic_concepts_of_c_programming.pdfIn PDF document text
    • http://kamegil.epizy.com/32493046713.pdfIn PDF document text
    • https://a121017b-3fb3-450c-9156-48dd71a9bf80.filesusr.com/ugd/07625c_39001438a5a94b6c8e6273ff854eb96f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4c17e03-bdb8-4388-a929-0657832923b7/how_to_adjust_analog_time_g_shock_5081.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92a392a8-2337-4678-a2cd-060b2f68dae5/31660373718.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53bc1d87-02b1-47c1-bfc7-e8b245b6280e/54082306338.pdfIn PDF document text
    • http://faminosokaru.epizy.com/kabbalah_para_principiantes_gratis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/707bbd16-4777-4c85-9e69-578800ebe764/why_does_my_acer_laptop_screen_go_black_when_i_plug_it_in.pdfIn PDF document text
    • https://907864b8-ab38-4b43-b195-7646ee37c451.filesusr.com/ugd/c4b402_6fd1a990a23b49afb07e6904c4834977.pdf?index=trueIn PDF document text
    • https://57eba762-b826-4879-8d7a-7f480aba2934.filesusr.com/ugd/e89c2b_6201d574c1ad4b248989748d4ed9a0e1.pdf?index=trueIn PDF document text
    • https://d73c234d-0e3d-497d-8108-d5659bace061.filesusr.com/ugd/58a813_09ce4ecb92be401bb2894b6c817193f3.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb9c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB9C 6084 bytes
SHA-256: 94e59d8a70069ed1ea93dde71b899a8de5afdce0444768c602aa4e9d57a69085
font_01_sfnt_off0001004d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1004D 11488 bytes
SHA-256: 4fa3479496919ffbdb5c6d2f9737bf6f0a8a06a96d1b6fc57139e5cd30643dd8

Open this report in the interactive analyzer, or submit your own file for analysis.