Malicious PDF — malware analysis report

Static analysis result for SHA-256 f053d59c3675dad0…

MALICIOUS

PDF

85.7 KB Created: 2021-03-18 03:03:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: eac2a84f278090b787ba0cb38da37d73 SHA-1: 89db22a2852e0fe4ba841fcee7483240a4ad1904 SHA-256: f053d59c3675dad0e41fbd9a507bb4d5e32b596c3c21511357a6346836555a72
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/123?utm_term=behringer+u-+phoria+um2+driver+windows+10 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4446645/normal_600dea4fc8074.pdfIn PDF document text
    • https://pejopazuzaguwoz.weebly.com/uploads/1/3/2/8/132815183/51867.pdfIn PDF document text
    • http://samo-katim.ru/telofusubogexalz2mwd.pdfIn PDF document text
    • http://thiswaytovogue.com/real_drift_car_racing_game_download_apksywpv.pdfIn PDF document text
    • https://cdn.sqhk.co/semiwewedazi/jalbEuN/emergency_room_technician.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384634/normal_5fe4e93a3a00d.pdfIn PDF document text
    • https://nuguzawopaji.weebly.com/uploads/1/3/4/0/134040365/mujigop.pdfIn PDF document text
    • https://cdn.sqhk.co/pedajobu/pjfjcie/smart_meters_law_california.pdfIn PDF document text
    • https://wevinavuligi.weebly.com/uploads/1/3/4/5/134505150/6681c.pdfIn PDF document text
    • http://secret-empire.ru/red_alert_4_download_full_version_pccpkcb.pdfIn PDF document text
    • https://vumirexow.weebly.com/uploads/1/3/2/7/132740730/rirozugamirafifegux.pdfIn PDF document text
    • https://cdn.sqhk.co/kurotevu/dgiiegh/68250968905.pdfIn PDF document text
    • https://vezitiratad.weebly.com/uploads/1/3/1/8/131856143/vulekosekiguv-tobij-disekozapiduzul-kubiwuxoretek.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386593/normal_6013ed78364da.pdfIn PDF document text
    • http://pufegusikozig.22web.org/74179965863.pdfIn PDF document text
    • http://hiziryigit.online/how_to_install_honeywell_rth2300_thermostat_with_2_wiresko8rt.pdfIn PDF document text
    • http://cardioactiveufficiale.site/tabasobav31gkq.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371267/normal_5feb7667a3ff1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/02534a09-b05f-4d16-ae0c-842ba0bd41e9/personal_microderm_elite_pro_reviews.pdfIn PDF document text
    • http://sewusewevivezu.rf.gd/2329607205.pdfIn PDF document text
    • http://rubuvajaroxe.epizy.com/58790938885.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0e605f7-d78c-4b75-8e90-7ca14298d3b8/did_bassanio_really_love_portia.pdfIn PDF document text
    • http://laxiruzeremifam.rf.gd/ielts_speaking_part_2_questions_and_answers_top_50.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/418f1602-b34f-4dd1-8cc9-67d07a156074/landmarks_in_humanities_4th_edition_free.pdfIn PDF document text
    • http://jeparilusukopof.epizy.com/geremobesev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/135566a4-8118-4ca3-8617-3d6987a49dcf/genie_3024_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/329b66b8-b256-40b9-be5e-2a446574048a/60528233009.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F32 5900 bytes
SHA-256: 6fb51db6cc08d5366dfa90edb6b83d23071551342d16b0d6820a8d7f7fb27c37
font_01_sfnt_off0001233f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1233F 10940 bytes
SHA-256: 3ea92b910246b30948b5c0a2f71738184fc9c41c6f026a84fd359c4e9e12b75f