Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4afe0b48bda38c2…

MALICIOUS

PDF

70.3 KB Created: 2021-04-06 05:18:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 7450d8afcba6e13d2d924f4cc2686557 SHA-1: e99c3eab30991a9ead86bce82a2654ce0cfd5237 SHA-256: e4afe0b48bda38c29ccf5cc8c3e4067db9cd99b5bdce1c6ad43ab63763a035d1
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by multiple heuristics and an ML classifier, specifically flagged as a phishing trojan. It functions as a link farm, directing users to various external PDF files hosted on disposable domains, likely as a method to distribute further malicious content or engage in phishing. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the presence of numerous external links and the 'PDF_SEO_LINK_FARM' heuristic strongly suggest a deceptive purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=acupressure+points+pdf+free+download PDF link annotation
    • https://gupuvuzuguzi.weebly.com/uploads/1/3/1/3/131379578/3439694.pdfIn PDF document text
    • http://dowotezovemalo.mygamesonline.org/bailable_and_non_bailable_offence_crpc.pdfIn PDF document text
    • http://regudak.iblogger.org/7907491760.pdfIn PDF document text
    • http://xanusojuruxu.sportsontheweb.net/bogoxufufejefufutexin.pdfIn PDF document text
    • https://romuxejis.weebly.com/uploads/1/3/4/8/134887308/bonipufinud-gifebulolo-tidukudak.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://eac5c218-d238-408c-98a6-8ff0ecbb25fc.filesusr.com/ugd/b1277d_61ea60e53442401691d1bab5e5edbe37.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/708e5e3d-5d72-43fe-a500-e214140cd016/vowaxigifupukape.pdfIn PDF document text
    • https://6c8ebe11-725c-420b-823a-68bc39d02ad2.filesusr.com/ugd/3e87bf_c79a0e7267c14eea99ebb7b4e1363d70.pdf?index=trueIn PDF document text
    • http://jidafamibudajir.epizy.com/40892263869.pdfIn PDF document text
    • https://f3dbd103-cf2f-44fc-b0ad-c9004dc38af2.filesusr.com/ugd/1f2646_afc135deea4346d89cd6aeb8ec453613.pdf?index=trueIn PDF document text
    • https://4095172d-bd2f-4181-91d7-dd424e653400.filesusr.com/ugd/df73ab_b1775fbe26df41a79a7120fda5da8885.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/accd2870-1b30-4c46-b8be-1f1e295a838e/what_fruits_are_good_for_gluten_free_pasta.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f0a6ad5-0d85-41a1-9996-f0d413f35e75/whirlpool_edr3rxd1_everydrop_refrigerator_water_filter_3_lowes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/352ccc26-a554-4b20-a8bc-cc13d36ede42/wedusodivakewipobojotewed.pdfIn PDF document text
    • https://6843e3eb-5573-46e1-90a0-370cfc2b4a0d.filesusr.com/ugd/89b1bc_f2a9e68803344a3581d4e80da17c3dce.pdf?index=trueIn PDF document text
    • http://xedawobu.atwebpages.com/84785541706.pdfIn PDF document text
    • http://namakanexir.atwebpages.com/probabilidad_y_estadistica_para_ingenieria_hines.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8432740-0de3-4491-9d5d-d9b68d92c780/93858624616.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d32fb58-50e4-4418-9759-f5ebefa94b9e/doraemon_movie_stand_by_me_2_trailer_in_hindi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6704fd91-5ffb-4e51-9f1f-c465e53955c3/9159532229.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d528.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD528 5228 bytes
SHA-256: 022411690d6a7052472dcedd17572bffb8cd20a197c4efffd34f1d7a0b5886f2
font_01_sfnt_off0000e715.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE715 10692 bytes
SHA-256: 66d49fd78c2f15256e669d60244b68ca54cc949b7142bfd5bfc6be72d97288b6