Malicious PDF — malware analysis report

Static analysis result for SHA-256 f11409080c1fa796…

MALICIOUS

PDF

91.1 KB Created: 2021-03-05 08:07:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: a8bb3822844faf876907212b2be9ee76 SHA-1: e727c5dbc2e2cacf5e56d4d56069fe4d722a3496 SHA-256: f11409080c1fa796537ee4c64126f0108e598b458fe4cf2fd3c9da0aa9001809
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by ML classifiers and ClamAV, and contains a large number of external links to disposable hosting domains. The PDF_SEO_LINK_FARM heuristic indicates a link farm structure, suggesting the primary purpose is SEO manipulation or to serve as a distribution point for further malicious content. The presence of embedded URLs and the overall structure strongly suggest this file is part of a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=jim+goad+answer+me+pdf PDF link annotation
    • https://xukovefekafevut.weebly.com/uploads/1/3/0/9/130969731/5457692.pdfIn PDF document text
    • https://tawatoxox.weebly.com/uploads/1/3/4/0/134018263/6a95f1cfecc.pdfIn PDF document text
    • http://chambreop.xyz/mulaneximezojokimasorakav84x.pdfIn PDF document text
    • https://dodilepu.weebly.com/uploads/1/3/4/4/134444379/4608305.pdfIn PDF document text
    • http://linza.media/terror_in_the_mind_of_god_juergensmeyerjjpts.pdfIn PDF document text
    • https://pogiwubuwafax.weebly.com/uploads/1/3/0/7/130775808/wapemumuwon_gupikesokerod_ritoko_lenakukisom.pdfIn PDF document text
    • https://zanixikowupu.weebly.com/uploads/1/3/1/4/131437740/puvalamezas.pdfIn PDF document text
    • https://vigodabazo.weebly.com/uploads/1/3/4/8/134872933/3b20f09.pdfIn PDF document text
    • https://widetidutu.weebly.com/uploads/1/3/1/4/131453832/4894008.pdfIn PDF document text
    • https://xuvelufuxilo.weebly.com/uploads/1/3/5/3/135387868/8686052.pdfIn PDF document text
    • https://nimukebobe.weebly.com/uploads/1/3/4/5/134527887/muxof_derexirefoxavid.pdfIn PDF document text
    • https://zopupafi.weebly.com/uploads/1/3/1/4/131454349/fojet-wexonutunojige.pdfIn PDF document text
    • https://kevesotajomuvow.weebly.com/uploads/1/3/5/9/135959451/95cd748b280cbfe.pdfIn PDF document text
    • https://zofizefeva.weebly.com/uploads/1/3/1/6/131636954/merok_xurexutow_zafozosulok.pdfIn PDF document text
    • https://dazuzoboda.weebly.com/uploads/1/3/4/0/134017564/puboxijarude.pdfIn PDF document text
    • https://sojabejob.weebly.com/uploads/1/3/4/8/134890412/9131236.pdfIn PDF document text
    • https://jigupipugefelo.weebly.com/uploads/1/3/4/3/134387822/9c3942d8f4d38.pdfIn PDF document text
    • https://pijaxulejogelub.weebly.com/uploads/1/3/0/8/130874219/bowexosivojo.pdfIn PDF document text
    • https://makemugajisere.weebly.com/uploads/1/3/5/3/135317455/1c5ab64b2ad0.pdfIn PDF document text
    • https://vefibaxo.weebly.com/uploads/1/3/1/3/131379874/puvavoxikuzafo-gibigupawejetog-kexijib-dolewo.pdfIn PDF document text
    • https://sazefowefojewen.weebly.com/uploads/1/3/4/8/134893887/widavuripitekotuzuji.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://054d5c26-596f-48a3-87a7-0fc79031e5db.filesusr.com/ugd/599026_72b61913d2194a29a741656a81e63049.pdf?index=trueIn PDF document text
    • https://5a20c861-23fd-468b-888e-078c5342874f.filesusr.com/ugd/924841_ba2e7915055e4e90a1eed9109b82d705.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012716.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12716 5408 bytes
SHA-256: 121528a97392dcff822e1d56671751a5787417437382be8c57416d2a055cda98
font_01_sfnt_off00013977.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13977 11024 bytes
SHA-256: e111df08a17658b0f2ba8d2895ccd5d1bc4f3aa6c46f90839f02dbb9fc4388d2

Open this report in the interactive analyzer, or submit your own file for analysis.