Malicious PDF — malware analysis report

Static analysis result for SHA-256 f10cec925de5ef54…

MALICIOUS

PDF

105.5 KB Created: 2021-04-12 16:17:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 2934ea194ebc1262d96cf754969c5bdb SHA-1: 245ef6f3ce9ac77fdc4dd993dbabd300cd8421a1 SHA-256: f10cec925de5ef5495194adbcf583bb14748a1189ea63c20be69dff99ea4b057
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain that appears to be part of a link farm designed to redirect users. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests the document is intended to host many links on disposable hosting, further supporting a phishing or malware distribution scheme. No scripts were extracted, but the presence of external URIs and the link farm heuristic strongly suggest the document's purpose is to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=contrato+de+arrendamiento+de+casa+word+mexico PDF link annotation
    • https://cdn.sqhk.co/wekonexiw/sghFUhb/82812989130.pdfIn PDF document text
    • http://milano-moda.space/crystal_reports_runtime_13._0._22ajcpq.pdfIn PDF document text
    • https://mabaxezo.weebly.com/uploads/1/3/4/7/134766945/8076538.pdfIn PDF document text
    • https://cdn.sqhk.co/dogutadova/R77hbdz/dasalevazirur.pdfIn PDF document text
    • http://covidcapsule.world/get_your_guide_iceland_contactmniii.pdfIn PDF document text
    • https://furimulu.weebly.com/uploads/1/3/1/4/131411024/693081.pdfIn PDF document text
    • http://makamar.tech/kung_fu_panda_turtle_memeg7gqa.pdfIn PDF document text
    • http://ergors.space/big_helmet_heroes_mod_apk_0._4._03r57l.pdfIn PDF document text
    • https://cdn.sqhk.co/zoboxoba/igeJCjd/download_trainer_alien_shooter_2_reloaded.pdfIn PDF document text
    • https://romidawuro.weebly.com/uploads/1/3/2/7/132712233/laseridarabaput-gegodugosugew-ximavofedemuwum.pdfIn PDF document text
    • https://lepifokofufup.weebly.com/uploads/1/3/4/0/134018260/nelezanubowipaz-litibetebeju.pdfIn PDF document text
    • http://lnstagramsupportlives.com/hoover_max_extract_carpet_cleaner_not_suctioningadrxn.pdfIn PDF document text
    • http://robot3.site/pukifibogomafazerebym4l.pdfIn PDF document text
    • http://copyrightreports.com/lokujegewedejasorulinegw41zm.pdfIn PDF document text
    • https://xodefoxewez.weebly.com/uploads/1/3/5/3/135325776/1754002.pdfIn PDF document text
    • http://copyrighthelpptteam.com/totofouv2qz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d445c9d-55a2-4b90-9ca2-c981337c92a2/python_dictionary_update_all_keys.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea9a5c04-3424-4b71-9757-fb8adb0601b0/the_boy_who_harnessed_the_wind_rotten_tomatoes.pdfIn PDF document text
    • http://wezojepodi.rf.gd/termination_letter_format_for_unauthorized_absenteeism.pdfIn PDF document text
    • http://ximizadoxa.epizy.com/automatismos_industriales_editex_gratis.pdfIn PDF document text
    • http://gaxokumixopo.epizy.com/20394718506.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011df9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11DF9 6744 bytes
SHA-256: ffeb89eaad713c9717385028f79c9757067aafb2c2382ea8cbab0e6efe35a425
font_01_sfnt_off00012eb0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EB0 2952 bytes
SHA-256: 6f6c5a8fb5e62cfd2b6ff76f758e0f05a98695d5bac735cd019a42cb5e5649ba
font_02_sfnt_off0001393d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1393D 5116 bytes
SHA-256: bb6d75c302cad16daac596b1abd89508a7fadadbb144ce7383458ba446bba340
font_03_sfnt_off00014a96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A96 3208 bytes
SHA-256: 574e875c0fedffc8a4d0eca258824079351dcc5d1475f1e536e4ce9340b18e84
font_04_sfnt_off00015770.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15770 12376 bytes
SHA-256: 20a8e935b4a550d1505e27da9a51a04a56d46f33c46a479660d004f79bf20490
font_05_sfnt_off00017f7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17F7B 16240 bytes
SHA-256: 38bf8b4c0ea09ab7f411f253617ed0d86d1416a9fc6e4bdec1ba4f62e3559969

Open this report in the interactive analyzer, or submit your own file for analysis.