Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd0d080fea1d66a6…

MALICIOUS

PDF

78.2 KB Created: 2021-09-27 13:20:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-25
MD5: 3f9acc33105b57cba36f603339389121 SHA-1: ef405358fea40c838065d7ccf81a887bcdf7e2b7 SHA-256: dd0d080fea1d66a61ad197dc3c7e8592509b3df44476e3bf8ca2031c187333ec
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests the document is designed to host numerous links on disposable domains, likely for phishing or distributing further malware. The presence of external URIs, including one with a 'utm_term' parameter suggesting tracking, reinforces this conclusion. No scripts were extracted, but the overall structure points to a malicious link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=angry+birds+2+apk+hack PDF link annotation
    • http://parilka.by/var/upload/file/bifazazolubof.pdfIn PDF document text
    • http://studiospazioambiente.it/userfiles/files/sixewogerenibusef.pdfIn PDF document text
    • https://www.quatainvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16139d59c59d7b---277987774.pdfIn PDF document text
    • http://baracenter.be/userfiles/file/50824141022.pdfIn PDF document text
    • http://alt-1c.ru/userfiles/file/99390674022.pdfIn PDF document text
    • http://studiopol.com/userfiles/files/77591451259.pdfIn PDF document text
    • http://master-vin.ru/files/file/29623866345.pdfIn PDF document text
    • https://ddc-touggourt.dz/ar/files/21657081679.pdfIn PDF document text
    • https://gcs.kz/data/content/file/wiruraseduf.pdfIn PDF document text
    • http://musicpark-live.com/userfiles/file/11690415308.pdfIn PDF document text
    • https://derfo.info/resimler/files/wekibotezarifafewon.pdfIn PDF document text
    • http://blueyee.com/upload/file/061152487851.pdfIn PDF document text
    • http://fantasymusic.it/userfiles/files/kuridixarafapedof.pdfIn PDF document text
    • https://www.retake.dk/ckfinder/userfiles/files/48270709535.pdfIn PDF document text
    • https://euronet.stonavka.cz/webpagebuilder/ckfinder/userfiles/files/21936828985.pdfIn PDF document text
    • https://chameleoncoupons.com/adgprocessing/uploads/files/lijakab.pdfIn PDF document text
    • http://flyingkirin.com/uploadfiles/file/07171314367.pdfIn PDF document text
    • http://amsasecretariat.fr/userfiles/file/gedosinofisaludunigoziv.pdfIn PDF document text
    • https://lighthousemacau.com/html_upload/file/jorixo.pdfIn PDF document text
    • http://www.lebedosapartotel.com/data/yukle/files/duvewivaremopukurivosikek.pdfIn PDF document text
    • http://francescasciortino.it/userfiles/files/lojesilonevujalixoduruv.pdfIn PDF document text
    • http://circolonauticofavignana.it/userfiles/files/51716530849.pdfIn PDF document text
    • http://www.absolutecateringla.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614b2389c58bc---fejijewilesixolilupojar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c3ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC3CA 21540 bytes
SHA-256: 304988f222a29c1c8b6c2cd47e6cd0a166e4a40756691dd9ec94d383daa6e1fd
font_01_sfnt_off0000fa85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA85 10844 bytes
SHA-256: 0ffe0d281eb93e57b3c7360d470d8927c00cc333373242dcb5ca4b209e85b7bf
font_02_sfnt_off00011323.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11323 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.