Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea33b1fdaff81d1d…

MALICIOUS

PDF

124.5 KB Created: 2021-05-05 21:40:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f4f2c9c9dc216f3cd4abaa7ecefe0b0c SHA-1: b0111537faa890e8a23c8a2aa007fecb99817c0d SHA-256: ea33b1fdaff81d1d0b13050d18d549551dfd2ef1e6e0341af9da2d286f2efc94
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm designed to redirect users. Heuristics like PDF_SEO_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM strongly suggest this malicious intent. ClamAV detection and ML classification further confirm its malicious nature, likely serving as a lure for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=maven+java+eclipse+project
    • https://zifokodogip.weebly.com/uploads/1/3/1/3/131398222/tituji.pdf
    • http://hookup754.fun/keeping_the_republic_6th_brief_editionfywt4.pdf
    • http://firstreadersclub.com/mejiwodasarakifauhu6.pdf
    • https://gutinevar.weebly.com/uploads/1/3/4/6/134611255/c50c144.pdf
    • http://instasale.company/what_to_wear_to_a_fight_partyzizuu.pdf
    • http://creampiepow.club/el_completo_manual_del_suicida_onlin3qjqd.pdf
    • https://nefirekemoziwep.weebly.com/uploads/1/3/4/3/134332842/mifafiwa.pdf
    • https://najusijas.weebly.com/uploads/1/3/5/4/135400897/nuxidopute.pdf
    • http://arthromedro.xyz/defiant_outdoor_light_sensing_timer_instructions7uzhp.pdf
    • http://helpverifedbadges.com/xuzuzewodujw6nw.pdf
    • https://titawijuneve.weebly.com/uploads/1/3/4/0/134012454/1338978.pdf
    • https://raxagipob.weebly.com/uploads/1/3/4/8/134883443/2278467.pdf
    • https://fobolobal.weebly.com/uploads/1/3/4/3/134317950/9809415.pdf
    • http://idealslim-italiaofficial.site/rilatevimurukivujedipevu6n9rs.pdf
    • https://sajoviginuxux.weebly.com/uploads/1/3/2/7/132712139/06022d.pdf
    • https://vagobodowi.weebly.com/uploads/1/3/4/6/134600101/bosekenikedez-sujudib-dagag-lekifu.pdf
    • https://wadasazaba.weebly.com/uploads/1/3/3/9/133999184/mavodi.pdf
    • http://keepqifi.site/nature_ralph_waldo_emerson_annotatedtnfcv.pdf
    • https://surutadalonuta.weebly.com/uploads/1/3/1/4/131455158/cf8da.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/00768935-7278-442d-b662-32301150360b/98055874416.pdf
    • https://uploads.strikinglycdn.com/files/aaf96d1b-16b6-4093-b1ec-3a9b54e4396b/rekodu.pdf
    • https://uploads.strikinglycdn.com/files/c14c882b-260f-45a2-8407-d4c9971e2cc0/cognitive_behavioral_therapy.pdf
    • https://uploads.strikinglycdn.com/files/1bb18b10-4d98-4a35-ae83-767f891de9a2/old_yeller_book_characters.pdf
    • https://uploads.strikinglycdn.com/files/4e78a6cb-1d0f-4959-9a9a-e0ca95bc3ce7/motorcycle_diaries_book_vs_movie.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e335.bin
cfa7b8d4cbc1e58c259af095e62ed760cfc9b81cff1cca9072acc4684c06b306
pdf-font-stream PDF embedded font (sfnt) at offset 0xE335 67284 bytes
font_01_sfnt_off0001ad92.bin
2ecc466bfe5c94ab4f9fa4dba0687377fc1a776cc91ccaf5390489b969198196
pdf-font-stream PDF embedded font (sfnt) at offset 0x1AD92 5068 bytes
font_02_sfnt_off0001bef8.bin
bc98700b4108d501d670fd4d23efa642e7d2d4ed0bedb5501b3eca5022f83d30
pdf-font-stream PDF embedded font (sfnt) at offset 0x1BEF8 10348 bytes