Malicious PDF — malware analysis report

Static analysis result for SHA-256 e649017705c66a52…

MALICIOUS

PDF

100.9 KB Created: 2021-04-13 19:51:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 6a48b8dc6e11c09883c5f83033c128dc SHA-1: 858a08ec2b85adf373a7234bc5c06fb972e6011b SHA-256: e649017705c66a529b08276aab6109dfebc54ffc1a999987b2a60a00630d8ec2
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=delta+scroll+saw+problems PDF link annotation
    • http://gutowofobujibos.iblogger.org/cbse._net._in_answer_key.pdfIn PDF document text
    • https://cdn.sqhk.co/bedogipaxog/Qgehiid/alienware_keyboard_lights_turn_on.pdfIn PDF document text
    • https://cdn.sqhk.co/zanuvajebodu/hd1gjig/snapping_turtle_habitat_facts.pdfIn PDF document text
    • http://dazolovegom.mygamesonline.org/fufidunilakebabapa.pdfIn PDF document text
    • http://poxinezov.iblogger.org/97146084853.pdfIn PDF document text
    • https://cdn.sqhk.co/lajawawinu/jijgHoe/nijusotewezevidapejinoloj.pdfIn PDF document text
    • http://jivopifavu.22web.org/37958136994.pdfIn PDF document text
    • http://jadogaxarabu.mygamesonline.org/74791226931.pdfIn PDF document text
    • https://cdn.sqhk.co/jidulopavoji/idhaF29/bomb_squad_modding.pdfIn PDF document text
    • http://taxatuwu.iblogger.org/fikizolidilo.pdfIn PDF document text
    • http://punevufazeji.iblogger.org/free_chrome_apk_packager.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://xodojes.epizy.com/fujimikadejuxox.pdfIn PDF document text
    • http://ganipevamos.rf.gd/pijusinabipufixugapefa.pdfIn PDF document text
    • https://s3.amazonaws.com/tadevewuju/73481016651.pdfIn PDF document text
    • http://posexafose.epizy.com/5342177476.pdfIn PDF document text
    • http://dovolexobitazu.epizy.com/srs_for_book_bank_management_system.pdfIn PDF document text
    • https://s3.amazonaws.com/debamijizozexo/xajimolete.pdfIn PDF document text
    • https://1923692e-f727-4f58-80a8-3583160180e3.filesusr.com/ugd/c4ccc4_39166d9f9eb74b50bbe06417622c7d00.pdf?index=trueIn PDF document text
    • https://fad58b31-c538-4d3f-828d-7998eec853b9.filesusr.com/ugd/7e6083_cb36ebd1fdf443a3a63edb4e72d34176.pdf?index=trueIn PDF document text
    • https://ce3a146a-d504-4efb-981c-4593fb85d965.filesusr.com/ugd/5b5da7_5b271bbec97f464c928d2e1a702077e2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jagux/netgear_ac1600_router_installation.pdfIn PDF document text
    • https://ef90beaa-bca2-431e-862c-49c19dd94618.filesusr.com/ugd/06497e_e444723991b947c297098d93f13571c6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sesijesule/13244926860.pdfIn PDF document text
    • http://nakosaf.rf.gd/school_annual_sports_report.pdfIn PDF document text
    • http://lugenizuridaj.atwebpages.com/kerala_lottery_onam_bumper_2020_result_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014a67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A67 5308 bytes
SHA-256: a40d1684112534b735d6f6f685a93021112824de55310787431978f626e1ba51
font_01_sfnt_off00015c76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15C76 11704 bytes
SHA-256: df69889f1405006db58be05d13b988d13b65e8bba95098c55d874ceba33faac3

Open this report in the interactive analyzer, or submit your own file for analysis.