Malicious PDF — malware analysis report

Static analysis result for SHA-256 e111c471c8a1e332…

MALICIOUS

PDF

80.5 KB Created: 2021-03-08 04:49:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-29
MD5: 029e942ed8f92db1179e4b7d69cdb2f7 SHA-1: 452352910c32ba28a4b5f5184349c86f0eae3552 SHA-256: e111c471c8a1e332fa6b0ef26ce85ea064efda762cc6ddbb50275b249835899c
244 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains numerous embedded links, many of which point to a link farm hosted on disposable infrastructure. One critical heuristic identified a link to known malicious redirector infrastructure at 'https://dafemum.ru/123?utm_term=york+furnace+serial+number+lookup'. The presence of a large number of external links and the redirection to a suspicious URL strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=york+furnace+serial+number+lookup In PDF document text
    • https://kaxojolomo.weebly.com/uploads/1/3/4/8/134885197/e8cf58b.pdfIn PDF document text
    • https://lopowizuxo.weebly.com/uploads/1/3/4/4/134438001/rogupefegateku_dewufeziweg_pupufu_giboxajozo.pdfIn PDF document text
    • https://fobabugukejapa.weebly.com/uploads/1/3/4/5/134576868/5124767.pdfIn PDF document text
    • https://gunimesugudux.weebly.com/uploads/1/3/0/7/130776745/gaxobunolidonafu.pdfIn PDF document text
    • https://vatifogogunubit.weebly.com/uploads/1/3/4/7/134725392/7a9c2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8dc429c9-65e8-4861-81be-82bc4a1d30bf/2002_ford_ranger_service_manual.pdfIn PDF document text
    • https://d3df31c7-72fe-42b1-a92e-0723e8ed7a16.filesusr.com/ugd/5bf82b_cf129b28ed7e46c484132a6ffd9169cc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/farowug/17502046444.pdfIn PDF document text
    • https://7e8267f5-6380-480e-ad72-df526eaefc07.filesusr.com/ugd/cbe325_0bd8a919635443f5ac67c75bce6e0947.pdf?index=trueIn PDF document text
    • https://1ffb5d6c-d890-49e0-9b87-dc10fbfa49e2.filesusr.com/ugd/8bc2a6_305e40e569874c41ada41eb6237a184d.pdf?index=trueIn PDF document text
    • https://b6f97e74-198a-461d-a312-d71b9712332b.filesusr.com/ugd/a2d007_7fb9cd06049a44acb5568d36ba6bbde4.pdf?index=trueIn PDF document text
    • https://9849c7ec-8b19-4b81-9a64-db2537ea7c40.filesusr.com/ugd/97b1c0_0219e5402e7e42ceba59a1bca84131e9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f414e943-a046-4fab-9884-44d53a7618f8/how_breast_milk_is_produced_in_pregnancy.pdfIn PDF document text
    • https://70848fb0-0fd0-490a-9360-2ffa38fc212c.filesusr.com/ugd/08e331_90d2f3610c3d4335ae56d328191bd579.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/ruzumeb/35026472552.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/492b3d96-7263-45fb-9ac4-0703335cfb1b/what_are_the_rules_of_active_and_passive_voice.pdfIn PDF document text
    • https://ebed6276-6372-4ddf-adad-9a0fa504b99f.filesusr.com/ugd/805d2a_1a1817495b2e451e947bfe0c925ac78d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jasadavebaga/hold_onto_your_nuts_free.pdfIn PDF document text
    • https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_ce3aa9d5c8f3461cb0ce5d27706bed78.pdf?index=trueIn PDF document text
    • https://b5526579-b22d-45a0-8251-9885a72cf3eb.filesusr.com/ugd/0cd019_a57dab85579248aaaa261c1bf89466f0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rowubunak/analyzing_ecological_relationships_worksheet_answers.pdfIn PDF document text
    • https://2559d30b-64cd-4b4d-aaad-e76a675dde99.filesusr.com/ugd/f5a024_98ded3d6edb143d291a3193bafe1d5ee.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec7e5b72-b9e9-4b2c-9e3a-c86fc6571be0/votowegenalizozuvunom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/71d98dc4-46f6-4106-a797-c140ec92b8d8/44780850782.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBEC 5328 bytes
SHA-256: de2a6b585554ab0a5a4c5594a76a7f752e1b551f61ade41c912b6d8b55aca73c
font_01_sfnt_off00010df3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DF3 11404 bytes
SHA-256: ac6aa312d80c44bb05d6a19d500c941d719b260b3d45a259c8c5db30e84ecd89

Open this report in the interactive analyzer, or submit your own file for analysis.