Malicious PDF — malware analysis report

Static analysis result for SHA-256 e47c738278abd310…

MALICIOUS

PDF

91.7 KB Created: 2021-04-23 10:21:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: f298bc7010216bf24f49833717f5847e SHA-1: 09273e17faaa54921d0c8ed33be5e18f15750535 SHA-256: e47c738278abd3108f7933191249206565965da56d74aa79166c58abf9317244
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=what+is+the+best+power+pole+saw PDF link annotation
    • https://cdn.sqhk.co/kamozipu/dvsgiid/69051801032.pdfIn PDF document text
    • http://garantiya62.ru/likoxkj0aw.pdfIn PDF document text
    • http://de-bewertung-889562.icu/2008_jeep_wrangler_engineu2hm4.pdfIn PDF document text
    • https://cdn.sqhk.co/jozazixefuf/PPXgjs1/36334307605.pdfIn PDF document text
    • https://cdn.sqhk.co/gebunemif/jd7Yjj8/wokavidanixol.pdfIn PDF document text
    • http://montana-media.com/what_does_the_bible_says_about_peacex49h4.pdfIn PDF document text
    • https://cdn.sqhk.co/fojevimexu/eNjamjh/mirejolupoxuzabomifevijon.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/69db92ae-3fc0-44e2-81f1-fe158a42c04f/bonubamavuf.pdfIn PDF document text
    • https://s3.amazonaws.com/xixonu/88960372224.pdfIn PDF document text
    • https://6f8cb219-4830-455d-9ced-b55e65700e85.filesusr.com/ugd/fd30ac_1370ce32bb424814840e73b97c0a2e78.pdf?index=trueIn PDF document text
    • https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_048003225fc145f6baac2bc7255f1299.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0aa07fc4-cbf0-4cca-a862-80626aac8899/tp_link_tl_wa850re_reset_password.pdfIn PDF document text
    • https://s3.amazonaws.com/fisulefajow/accountant_client_termination_letter_template.pdfIn PDF document text
    • https://56148a0a-83a3-4003-94ff-78d3044b7c00.filesusr.com/ugd/6f5f23_782ccf288d20429eba1cead8e8c065c6.pdf?index=trueIn PDF document text
    • https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_98806719342c443da047e5bf97b69d0e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wewiro/evenflo_chase_select_lx_reviews.pdfIn PDF document text
    • https://7fca5364-97a1-4441-b76e-d2c429a59218.filesusr.com/ugd/735424_c9842ab2670d4bd89d1ed801ea867923.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dinigugaxej/self-_advocacy_information_definition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62b02040-5b2e-48e6-ac35-61cd065cf846/calculus_definition_text_structure.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c66b4019-b396-4817-a5bd-9125f29ad0a2/doredokosagojerumijuxo.pdfIn PDF document text
    • https://b1b1ed1d-a631-407f-b8a0-2f609481a9c2.filesusr.com/ugd/3e5895_bd7a698aaa394e14ad2f1a63dd42634a.pdf?index=trueIn PDF document text
    • https://c18d9829-3add-4afa-bc87-35007fe3998a.filesusr.com/ugd/70c1ec_13bbc1eb35624840a1f5f90e9dcf7360.pdf?index=trueIn PDF document text
    • https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_6308d00ed69b4a63bc523e7e6474df10.pdf?index=trueIn PDF document text
    • https://011f98f8-b45f-4578-a2fd-466b530f7845.filesusr.com/ugd/74e905_46537641300a493caecf1785d12afac5.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001289f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1289F 5152 bytes
SHA-256: fd56cdd3cb051f78da58766938ac6ef1143e97a9963f122e0f0b818e9f413b29
font_01_sfnt_off00013a33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13A33 11372 bytes
SHA-256: 02fe7cb07853ff0bde9a9ae32bf5881cb3fa6d50650cc9ffc1f66cf36d2e3a0a