Malicious PDF — malware analysis report

Static analysis result for SHA-256 de712765526a8f45…

MALICIOUS

PDF

89.1 KB Created: 2021-04-04 13:34:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 23d0b1cc1821adb28e76b862506bfef4 SHA-1: 4025f52de7af4aa452d127d57a2b9ba74c781463 SHA-256: de712765526a8f45e8083e8cbff0612e2b7848effeb94e6111dfa8e38011e564
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, directing users to numerous external URLs, including suspicious domains like 'ponafet.ru'. The presence of a large number of external links within a small PDF suggests an attempt to manipulate search engine rankings or distribute spam content, rather than providing legitimate information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=international+law+master+in+uk PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4486374/normal_5fe81a392cc38.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412583/normal_601678c201824.pdfIn PDF document text
    • http://gazzsheff.xyz/the_amityville_horror_1979_moviectydo.pdfIn PDF document text
    • http://top-odejda.com/8886357853u2z9h.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497685/normal_5fd61e8008a2a.pdfIn PDF document text
    • http://vugivanasidej.22web.org/fortinet_firewall_100d_datasheet.pdfIn PDF document text
    • http://bigchance.pw/risimotukereinedz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481409/normal_605f3cef51177.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372104/normal_5ff4a5ef00436.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0fa9f66-9fec-4008-981a-93e246bdcd0e/43834117236.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9827ada-ea53-4fe4-a984-b8cb34222bfb/fifty_shades_freed_movie_ending.pdfIn PDF document text
    • https://e668d0bc-6b9c-4787-ac64-5363b724ef62.filesusr.com/ugd/6ec699_8df3f2d829b3467799e9e4cf66502882.pdf?index=trueIn PDF document text
    • http://rubigireluj.rf.gd/3969283273.pdfIn PDF document text
    • https://c788b29d-df2d-4d46-9946-349e8cce89b7.filesusr.com/ugd/a9e086_aae1abe851964c149a8290ec10ee478c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b9af068-2267-408f-8ae7-c3e79c6d1baf/the_confidence_gap_katty_kay_and_claire_shipman_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1442262a-aef7-4ce8-b0df-dbcd7030be4b/bemixovuvo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9331ed4-f5fb-48c5-b642-cb5e61220bb8/domelunalowunemowulugi.pdfIn PDF document text
    • https://6d251753-49d0-4f5b-a278-10ed1cacc9d0.filesusr.com/ugd/5c139a_87cd47a6499f40af917b16bb4418b21c.pdf?index=trueIn PDF document text
    • https://737bf953-b780-43bc-8af0-312ed5328a40.filesusr.com/ugd/017c44_8a990f4756ab46679081f9af3272c297.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/00d60c4f-a6bb-4f07-b46c-0ca7735e1b28/how_to_use_maverick_thermometer.pdfIn PDF document text
    • http://kojajopi.epizy.com/gi_bleed_guidelines_thai.pdfIn PDF document text
    • https://203aa715-7352-46b1-b16b-5d0aeeaa27a2.filesusr.com/ugd/0582e0_478b4d6e607d4ba2878b50e578cfaa53.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8aa89bd7-30ba-4633-b37e-a4429b44c5b3/zeninamimodulifoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd42a8f7-4ccc-465b-99f8-7b70be9459be/tutibu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011ee5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EE5 4924 bytes
SHA-256: 7bdd23fd247b24e760ad2fb1d51ad857527005d639fa0ded3105ddc2b0b75de2
font_01_sfnt_off00012f9d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F9D 11480 bytes
SHA-256: f9ffc2bed4226b9bf12af759cbafe53e287bbb95d90e5ddda43fa131b3e0882d

Open this report in the interactive analyzer, or submit your own file for analysis.