Malicious PDF — malware analysis report

Static analysis result for SHA-256 f08d37c8f6c911cf…

MALICIOUS

PDF

98.0 KB Created: 2021-04-27 06:00:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: b810565903d66ab9b6df44b13a6e9a77 SHA-1: 5d92a728f710819ccfe71c7b2b5dd33a5d524b2b SHA-256: f08d37c8f6c911cf567d8d4007c5faf7b89cbd30dce78220c6986cb947eae522
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier with high confidence. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing operation. One prominent URL, 'https://fokemale.ru/strik?utm_term=how+to+write+an+opinion+piece', is presented as a guide, likely a lure to direct users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=how+to+write+an+opinion+piece PDF link annotation
    • http://technodom11.com/vaziropigimokuli285b.pdfIn PDF document text
    • https://bitusuverutito.weebly.com/uploads/1/3/1/8/131871453/mabojejavofabajinizi.pdfIn PDF document text
    • https://sisebafob.weebly.com/uploads/1/3/0/7/130776599/dofofuxigokop_xovutedupitesi.pdfIn PDF document text
    • https://cdn.sqhk.co/kosaboze/bCicsjd/mandated_reporter_cal_poly.pdfIn PDF document text
    • https://gidafefutor.weebly.com/uploads/1/3/4/0/134040883/muxeturom.pdfIn PDF document text
    • http://wordsideget.top/zuxomurunulp3gse.pdfIn PDF document text
    • https://jevokave.weebly.com/uploads/1/3/4/2/134266272/2770827.pdfIn PDF document text
    • http://fbcopyright-center.com/gorikinigarugimasonojolxy3s.pdfIn PDF document text
    • https://cdn.sqhk.co/pemazekefise/igPYjcE/transmission_fluid_change_how_often.pdfIn PDF document text
    • http://tehnikator.ru/are_turtle_beach_x32_compatible_with_xbox_onetjnfx.pdfIn PDF document text
    • http://opendouche.xyz/why_is_my_epson_printer_not_printing_black_textwneym.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://7be8961d-effb-4c78-a255-78c3c9f0be09.filesusr.com/ugd/3dd68e_f21a63c8e1c042ec9efc9a1d73eda7d4.pdf?index=trueIn PDF document text
    • https://6f465708-eb37-4ee2-8658-ebeec6cd93ea.filesusr.com/ugd/4bb103_e1bb7bd798064af0901d8c2f95152ffb.pdf?index=trueIn PDF document text
    • https://564fd4a8-0e6d-4f97-813a-a14a70c45316.filesusr.com/ugd/f90d28_b7bfab660328471280fff9e3f5927840.pdf?index=trueIn PDF document text
    • https://71fc3d66-43b2-4ae0-adc3-dfbcdf8b5360.filesusr.com/ugd/6605a0_8baf145a1715494582ac78c7e9d8b0b5.pdf?index=trueIn PDF document text
    • https://48e4e0df-78ce-4736-8797-27735e68dc67.filesusr.com/ugd/f3b179_89c1596948f24594b995fef18adcc52f.pdf?index=trueIn PDF document text
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_ca339801fa6645ee92079c2a2231efe6.pdf?index=trueIn PDF document text
    • https://8be25b45-535e-44bd-bc37-5b9d9533818e.filesusr.com/ugd/55f640_e38a7ea29aaa4e84a9e47672caae71ec.pdf?index=trueIn PDF document text
    • https://65d0a56f-4074-4e8f-9acc-29e6f8e8f663.filesusr.com/ugd/37655d_1fb0698f4d4845529033abd0ee3a4efb.pdf?index=trueIn PDF document text
    • https://8fa10226-37c2-454d-bd65-ced70ecbf0c4.filesusr.com/ugd/c34aa9_29801c26d8de4f8bb4b6ed4f7c319615.pdf?index=trueIn PDF document text
    • https://02aee961-309f-4c8b-9790-08f12c26706e.filesusr.com/ugd/8321db_e7957cd493cc43a88ee19ccd29f617be.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107F0 6960 bytes
SHA-256: 06631f18814540e1421a04b086bcb9d508edb92fdfd6c64e4897d85375d7c2d6
font_01_sfnt_off00011991.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11991 4768 bytes
SHA-256: 31404f20c0d3041927895fa7c4e3951c607526b0251786dd8acdfe480d4ed553
font_02_sfnt_off000129df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x129DF 5028 bytes
SHA-256: 7e11dd9583df40ec0fd0fb2a91c97ef75153f23fcf4aca652963c47a2e833cf4
font_03_sfnt_off00013c82.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13C82 11016 bytes
SHA-256: bd84334b2c997f9be5c141555c2cfeff548ad4661a534cbd5298fb1becf68c82
font_04_sfnt_off00016235.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16235 16328 bytes
SHA-256: c4483d0a2685d558df97df6ba840746f2870e6254d6d5d8edd69700eac20a654

Open this report in the interactive analyzer, or submit your own file for analysis.