Malicious PDF — malware analysis report

Static analysis result for SHA-256 db4e9202f19a32e3…

MALICIOUS

PDF

67.6 KB Created: 2021-02-15 09:21:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: 4cf65ceff3398971e7941525ffef39a9 SHA-1: 0f81b5749cd0b5a7bfd3039f9062ddfeac1c6a00 SHA-256: db4e9202f19a32e331410b51fa8a4c4833c0f45e0d5ab1817d9f3f997903e6af
212 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one specifically identified as a known malicious redirector. The document body, though heavily obfuscated, contains keywords like 'fishing report' and 'largo', suggesting a lure. The presence of multiple links to external PDF files, some of which are hosted on dynamic DNS services, indicates a potential link farm or distribution mechanism for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8464

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/aws?utm_term=fishing+report+key+largo In PDF document text
    • https://cdn.sqhk.co/vusutazomaga/5gkYwgs/t_mobile_ceo_contact_number_availability.pdfIn PDF document text
    • https://cdn.sqhk.co/supopareso/aqjh12h/bloom_s_taxonomy_words_for_objectives.pdfIn PDF document text
    • https://fumewalifo.weebly.com/uploads/1/3/4/8/134884483/jilovemif.pdfIn PDF document text
    • https://cdn.sqhk.co/mugukawi/jdsQS2f/rixeloxufaw.pdfIn PDF document text
    • https://cdn.sqhk.co/wefonasifaza/ih0WDif/books_to_learn_spanish_from_scratch.pdfIn PDF document text
    • https://cdn.sqhk.co/gubogezemazo/eAwVm2o/lisilepawoxerojikeleli.pdfIn PDF document text
    • https://cdn.sqhk.co/zamodozitip/gh3jcia/54327769560.pdfIn PDF document text
    • https://cdn.sqhk.co/miwizawi/XRzJGYc/switch_controller_pro_connect.pdfIn PDF document text
    • https://cdn.sqhk.co/xolanikipiz/gwlirUw/63919348639.pdfIn PDF document text
    • https://serirufudo.weebly.com/uploads/1/3/4/7/134712976/namobalazene-lazujimagi-gotirafez-lasidefa.pdfIn PDF document text
    • https://cdn.sqhk.co/povewepalu/eUnhfif/katepolej.pdfIn PDF document text
    • https://cdn.sqhk.co/levowexesu/3tjaFis/the_kreator_pyrmont.pdfIn PDF document text
    • https://cdn.sqhk.co/vomifavafo/0wHhfib/copper_beech_resident_portal_bowling_green.pdfIn PDF document text
    • https://cdn.sqhk.co/mosugukasiba/icqic2M/chicken_invaders_3_christmas_edition_download_full_version.pdfIn PDF document text
    • https://cdn.sqhk.co/fenazijeguk/dTfqgjW/fun_things_to_do_around_seattle_washington.pdfIn PDF document text
    • https://cdn.sqhk.co/xerejijasoma/njgajgh/real_super_spa_salon.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://lojosikol.epizy.com/differences_between_monocots_and_dicots_worksheet.pdfIn PDF document text
    • http://xesidif.epizy.com/a_r_d_ka_full_form.pdfIn PDF document text
    • http://zawomebi.epizy.com/amelanchier_canadensis_glenform_rainbow_pillar.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e11d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE11D 4988 bytes
SHA-256: e2657d7add5f4f54d4f11deff97cc6522803a50b512b6389a5a06637a029ace1

Open this report in the interactive analyzer, or submit your own file for analysis.