Malicious PDF — malware analysis report

Static analysis result for SHA-256 e29f61eacad70981…

MALICIOUS

PDF

81.1 KB Created: 2021-03-24 15:05:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: ef26e8ee28a81ff38f66c3275b944cd4 SHA-1: 0225c185d50285eea47932e9c1bd0aa786d5fd49 SHA-256: e29f61eacad70981b782930aae5e64bb4c5595d3448cc52a028d08cd504dacd4
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO manipulation tactic. One of the primary external links points to a URL that appears to be a malicious redirect or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=rumi+poems+love PDF link annotation
    • http://rodisawikikofu.medianewsonline.com/business_vocabulary_builder_advanced.pdfIn PDF document text
    • http://fopokigife.mywebcommunity.org/18229498487.pdfIn PDF document text
    • https://nakotugobal.weebly.com/uploads/1/3/5/3/135300729/9601211.pdfIn PDF document text
    • https://liberiloro.weebly.com/uploads/1/3/4/5/134589576/adcc1ebedc5.pdfIn PDF document text
    • http://xufelaketodo.getenjoyment.net/safeway_club_card_registration_canada.pdfIn PDF document text
    • https://vanizubifimid.weebly.com/uploads/1/3/0/8/130874516/lumezetumileba_rugutoxafapig.pdfIn PDF document text
    • https://mavezuwunokil.weebly.com/uploads/1/3/4/6/134627141/e58026181e1d.pdfIn PDF document text
    • https://merasata.weebly.com/uploads/1/3/1/3/131378960/1256439.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://dab7fb03-f2af-4a8e-9cb9-31de623bedb3.filesusr.com/ugd/58b596_526263993f57493c8b7472259346501c.pdf?index=trueIn PDF document text
    • https://fd0ef26f-7b8f-4c91-b3b2-19f7ec93487a.filesusr.com/ugd/4174bf_02c2ab0b502a4747bfef324fbae14b65.pdf?index=trueIn PDF document text
    • http://vedixemalirugi.atwebpages.com/is_the_irregular_at_magic_high_school_manga_finished.pdfIn PDF document text
    • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_4f01e7389a8c464fb852151cc7629ca7.pdf?index=trueIn PDF document text
    • http://bemabam.myartsonline.com/rarawarifinebugidasu.pdfIn PDF document text
    • https://77bac38d-831a-46d6-8f22-d7743fcadc58.filesusr.com/ugd/5b9a87_d45b1f5d066e40818d9c8cf6cb2f812a.pdf?index=trueIn PDF document text
    • https://ec2d952e-5494-46d8-b841-fee222248b17.filesusr.com/ugd/9713d5_e5c90de5e0bf41c2980e7d59439ca8e5.pdf?index=trueIn PDF document text
    • https://8cff94d3-ecab-4ea5-ad27-d3e67d02fd32.filesusr.com/ugd/2813e2_36295b2410364461bde85bbc5e57a4cf.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8de0ddda-4993-4e9e-a91f-09639cabc0bf/vocabulary_from_latin_and_greek_roots_unit_1_answer_key.pdfIn PDF document text
    • https://cef8af8d-7071-4339-ac50-fc417d371010.filesusr.com/ugd/a89196_31404f56a8aa47ba9a21a346b9dc939f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1897723-c218-45c2-b043-2c27c9078215/8887368185.pdfIn PDF document text
    • https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_07d7606f54c949e4810f8407fbb2fbae.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f8e572c-2044-4ca4-a00b-9527f1ea9e7a/beyond_the_wall_bed_and_breakfast_dunedin_fl_34698.pdfIn PDF document text
    • https://35479656-6a94-44d6-ac55-da507c14a2ae.filesusr.com/ugd/d68318_2254c63bd17e43798eb863f4bbec9b9a.pdf?index=trueIn PDF document text
    • https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_77a91b9a75234c70be52e1bff8f57d99.pdf?index=trueIn PDF document text
    • https://40ba1f7a-6e91-49bb-bbb8-dfbb40a2bc60.filesusr.com/ugd/22bf55_1d4b4263022b4e0886bd7be31e67aea4.pdf?index=trueIn PDF document text
    • https://0cc2a7d0-6f33-4335-9ec9-554d9418487e.filesusr.com/ugd/cb4a18_f78937db299a42ae8f320ea81b4a4886.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001006d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1006D 4724 bytes
SHA-256: 3e86180b088af2259daf3832900a787ca9b91da754e75d1a5d6e3f0abb903881
font_01_sfnt_off0001107e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1107E 10952 bytes
SHA-256: 241d4739ba0544ecd4751f44ea613215242bf73a81c124261accba1f51f35684

Open this report in the interactive analyzer, or submit your own file for analysis.