Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd827342d8a5c7f5…

MALICIOUS

PDF

76.9 KB Created: 2021-03-26 15:18:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 07d76549c07e5e7985ff5c0f6a91b076 SHA-1: 99498d572dffd67798447d36b189cc774ed50069 SHA-256: dd827342d8a5c7f504c70e9781c0b26aed71dccbbbcc6e5897082af769de74aa
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=sony+dav+tz140 PDF link annotation
    • http://dugules.iblogger.org/aide_memoire_math.pdfIn PDF document text
    • http://jewogipuwivi.medianewsonline.com/the_game_book_neil_strauss_summary.pdfIn PDF document text
    • http://komozazene.getenjoyment.net/qu_es_la_composicin_en_artes_visuales.pdfIn PDF document text
    • https://natumelazorog.weebly.com/uploads/1/3/4/7/134711419/didufewomo-wixujopitonoguk-zoxijaze-lagunuxokexawap.pdfIn PDF document text
    • http://kirakexig.mypressonline.com/best_operating_system_for_pc_2020.pdfIn PDF document text
    • http://wufamega.scienceontheweb.net/general_deterrence_theory_definition.pdfIn PDF document text
    • https://luminesip.weebly.com/uploads/1/3/4/1/134108660/87e723d33d0.pdfIn PDF document text
    • http://ridaxaki.mywebcommunity.org/table_of_thermal_conductivity_of_metals.pdfIn PDF document text
    • http://fexaranotoxepig.22web.org/where_to_donate_furniture_in_seattle.pdfIn PDF document text
    • http://miwuzobi.sportsontheweb.net/53315418729.pdfIn PDF document text
    • https://vatopefo.weebly.com/uploads/1/3/1/3/131398509/fukivozoxo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://pijularof.epizy.com/crystal_reports_totext_number_format.pdfIn PDF document text
    • http://nazedizabif.rf.gd/jaruguretasapafelajonegew.pdfIn PDF document text
    • https://74269c25-1731-4359-90d4-804f54ef9c1c.filesusr.com/ugd/b5973a_2e088347ef1a4f7e9dfc97413957a9ba.pdf?index=trueIn PDF document text
    • https://aa6eca1a-c690-4a36-985e-a873157a80b3.filesusr.com/ugd/081493_0d493e0b2c444e8da6ffa47be959adb6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vizegemawokaxe/kolezuzuboken.pdfIn PDF document text
    • http://wutesejib.onlinewebshop.net/sony_dvd_player_dvp_sr210p_remote_code.pdfIn PDF document text
    • https://s3.amazonaws.com/genedesowul/why_can_bruce_banner_transforms_into_hulk.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxutedi/37208029980.pdfIn PDF document text
    • http://bekusisit.atwebpages.com/equidad_de_genero_onu.pdfIn PDF document text
    • https://52468903-0e2d-47c5-babb-61e1d305d291.filesusr.com/ugd/32777b_20120bf061794c8f969a085855b20889.pdf?index=trueIn PDF document text
    • https://8eefcaf3-52f5-4123-8be5-b1f0aaeea45e.filesusr.com/ugd/1d3654_8ebda750fbaf46f8a70c3a44cf4355eb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/luworizesupox/kebiraxazukekewuxixabuj.pdfIn PDF document text
    • https://s3.amazonaws.com/rurovikejigibu/32231472922.pdfIn PDF document text
    • http://jowokepo.atwebpages.com/beware_of_dog_sign.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9A2 5112 bytes
SHA-256: f9d940db4feace5dbc08f257f7016bc64359da522194884e0de0c2a2174af715
font_01_sfnt_off0000fb3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB3E 13996 bytes
SHA-256: 1bc3e71034a9d7881850669983d9d8922375a4816ac583d84391da35b8892d1d

Open this report in the interactive analyzer, or submit your own file for analysis.