Malicious PDF — malware analysis report

Static analysis result for SHA-256 e802aeaccef1c420…

MALICIOUS

PDF

74.0 KB Created: 2021-03-08 21:18:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 13eadd1bd9d7be2edde68ad9cf64777b SHA-1: bd8a0e14f2817bf6f52b2d34bf011677da1854b4 SHA-256: e802aeaccef1c420c8b8847e771456851cbeadd84c648870b23fcf51165e2b97
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=degradation+of+fatty+acids+pdf PDF link annotation
    • http://internet-babki.ru/what_major_events_happened_in_187751aoi.pdfIn PDF document text
    • http://xisumagogali.getenjoyment.net/2108773260.pdfIn PDF document text
    • http://farvestnn.ru/how_can_i_check_status_of_my_irs_refund42aaz.pdfIn PDF document text
    • https://bewirupudafa.weebly.com/uploads/1/3/1/6/131607000/rodibesatazon-renogil.pdfIn PDF document text
    • https://rapofureduf.weebly.com/uploads/1/3/1/1/131164295/46687612c91b0.pdfIn PDF document text
    • https://fumitosebajogo.weebly.com/uploads/1/3/0/7/130740118/ec72b0a.pdfIn PDF document text
    • https://lisiladojorinin.weebly.com/uploads/1/3/0/8/130874519/0ca4d026.pdfIn PDF document text
    • http://lelekelosutov.getenjoyment.net/16103957539.pdfIn PDF document text
    • https://zojegidaluvimov.weebly.com/uploads/1/3/4/1/134109086/838313.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://pawozif.epizy.com/map_of_australia_states_worksheet.pdfIn PDF document text
    • http://ligunatiresid.epizy.com/castle_ravenloft_board_game_rules.pdfIn PDF document text
    • http://sujudokeki.epizy.com/pilgrims_progress_map.pdfIn PDF document text
    • http://bafilus.epizy.com/san_francisco_parking_violation_report.pdfIn PDF document text
    • https://91ca87c2-c493-4616-adaa-fbcec45394e1.filesusr.com/ugd/6116da_65b48166e1c94948bedeaedee16b8c35.pdf?index=trueIn PDF document text
    • http://sixategajufob.epizy.com/python_download_multiple_csv_file_from_url.pdfIn PDF document text
    • https://af0fe010-594a-4ec7-a26b-e2d78e33490d.filesusr.com/ugd/7d2910_10705d58fc034a08b63732bb6d4bafc5.pdf?index=trueIn PDF document text
    • http://fanofajuduma.rf.gd/22887879136.pdfIn PDF document text
    • https://f61a8d15-835b-4c36-a3db-e4ead73ab13f.filesusr.com/ugd/e9f5f3_990b19a333e64cd9a641ee70dd18dfbc.pdf?index=trueIn PDF document text
    • https://0296ecfc-28ae-4fa5-925c-67a25994cace.filesusr.com/ugd/c88839_495567f2cb4c4d728954eb9f8c0d1ecc.pdf?index=trueIn PDF document text
    • http://vifotuniso.rf.gd/angels_and_demons_book_series.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e377.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE377 5392 bytes
SHA-256: 58963ec27ac190821f681461b329ccdc064b5d95ccfe630f3ed46d65217cd8fe
font_01_sfnt_off0000f5f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5F0 10820 bytes
SHA-256: 02815b4bff009678463f3b663aac057403fbe2d0ea7b2df52c3e7d58299b38f3

Open this report in the interactive analyzer, or submit your own file for analysis.