Malicious PDF — malware analysis report

Static analysis result for SHA-256 deb8d64dd10a99ba…

MALICIOUS

PDF

79.8 KB Created: 2021-03-17 14:12:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: c31d82e9c966b45c96547fe76f2f3e5f SHA-1: c182bd3c9be9b6a451cbc6dadc2e79a7da184534 SHA-256: deb8d64dd10a99baca4b2e0626b109cfc11daa0a924ddfb6e976690477940edd
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, flagging it as a phishing trojan. It contains a large number of external links, many pointing to disposable hosting, suggesting it functions as a link farm. The primary malicious activity appears to be directing users to potentially harmful external content, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=brittle+deformation+is+different+than+ductile+deformation PDF link annotation
    • https://cdn.sqhk.co/lusimalifa/90SLEgh/elite_mobile_pet_services.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417669/normal_6036971fc59a2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471240/normal_5fe0cb0fa39c3.pdfIn PDF document text
    • https://cdn.sqhk.co/bamosabubesi/3whfyie/pakoxok.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476765/normal_60511b9965502.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389106/normal_5ff3d0c882241.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369663/normal_602448c26b234.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://gezixus.myartsonline.com/78803441126.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06bdf5f0-d4a8-49d5-9f21-8ecca9c8ca3a/what_time_did_the_blue_jackets_game_start_tonight.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/364a5781-3afb-4341-9f13-d8c3d15ce819/analytic_number_theory_lecture_notes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf7f83e1-67e1-4adb-ba00-6bd1718ead78/coleman_quad_pro_led_lantern_800_lumens.pdfIn PDF document text
    • https://aa6d2f86-95e2-42cc-897e-6bbd71c3a116.filesusr.com/ugd/78daac_3d2b96e2fccc446a938bc017c3dcab60.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/41fa68cc-cd44-4373-aaee-7798960a23b1/tovuxaten.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52ab35fd-e793-4c0e-b6dc-7191ade6fe35/zunesuruzisosojisoz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/613ec831-689c-4d28-b9dc-54c4b392fdc6/how_to_start_a_john_deere_snowblower_with_electric_start.pdfIn PDF document text
    • http://pudolajuji.atwebpages.com/37578173577.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a099a4b0-3cdb-425b-9922-08ed782aec8b/bob_revolution_single_stroller_weather_shield.pdfIn PDF document text
    • https://bb74f61c-7045-47bf-9a7e-968101ee373e.filesusr.com/ugd/81ef4b_08de2aee3a78438fa883a90fa2c4b671.pdf?index=trueIn PDF document text
    • http://feferabi.atwebpages.com/98653472582.pdfIn PDF document text
    • http://jimarol.myartsonline.com/is_2018_mustang_gt_reliable.pdfIn PDF document text
    • https://6baea7ca-81e4-4a11-8410-716433a99462.filesusr.com/ugd/764aaa_19b5735910b44e41914136945599132b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/629798c6-72e3-4949-9e2c-44b6e0c4c756/61607714351.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5E7 5308 bytes
SHA-256: 625c3577976868a14fcf92f0fa98bdc48212296b18dc220a24f13a5f68288440
font_01_sfnt_off0000f7cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7CB 10632 bytes
SHA-256: 43f9a713c4a72373ee4732c739466e2f599c237bbe84032a06365ff47fcbf043
font_02_sfnt_off00011c87.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C87 16060 bytes
SHA-256: 5b0d2701ab39d2f69c66d7d16c60d8db0b323aa0832947137e757b5401d27330

Open this report in the interactive analyzer, or submit your own file for analysis.