Malicious PDF — malware analysis report

Static analysis result for SHA-256 f212020c728d3fcb…

MALICIOUS

PDF

76.5 KB Created: 2021-03-07 17:43:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: a3c5878233a92cbf2140dbc068f4a3a4 SHA-1: 7c752e7c30ec01a81e91a4a8def03296f2ff49b1 SHA-256: f212020c728d3fcbacbd1687cc850864b187a86b3ea8c66438b024e2d6eb8c05
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV. It contains a large number of external links, many of which are hosted on disposable domains, suggesting a link farm designed to redirect users to malicious content. The primary URL identified is 'https://dugedepap.ru/strik?utm_term=brother+mfc+9970+service+manual', which likely serves as a lure for phishing or malware distribution. No scripts were extracted, but the PDF structure and numerous external links strongly indicate a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=brother+mfc+9970+service+manual PDF link annotation
    • https://wevuviwujito.weebly.com/uploads/1/3/1/6/131636984/lafamevosufaxu.pdfIn PDF document text
    • https://ragixadimeruwu.weebly.com/uploads/1/3/4/8/134897014/7f6ae4148d6ba.pdfIn PDF document text
    • https://pojasulexubu.weebly.com/uploads/1/3/5/9/135993084/6672910.pdfIn PDF document text
    • https://zagumukukawikam.weebly.com/uploads/1/3/4/6/134608037/kejowutixazowu.pdfIn PDF document text
    • https://lenatazuponos.weebly.com/uploads/1/3/4/8/134888684/bilonadozesonibaga.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/18810045.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7276be4f-f39f-494c-be8d-0ab98dcd2750/what_is_the_best_aperture_for_night_photography.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f56bd8f-131d-4f0c-b405-88ed9a650b3c/gofevapasusanimujas.pdfIn PDF document text
    • https://s3.amazonaws.com/ganubifirigevi/how_to_do_ruqyah_on_someone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a2393ad-88e3-4796-8c34-185e957cb311/how_to_do_a_two_tailed_z_test_in_excel.pdfIn PDF document text
    • https://ee60c613-3dd1-430d-b711-08e3dcbf0273.filesusr.com/ugd/19ce5d_655b662a37ab46539b3fc403a497b686.pdf?index=trueIn PDF document text
    • https://0491f86b-060d-4f4a-be23-b0d01488777f.filesusr.com/ugd/faa7ef_c1c8a441e1ab4bd69d0ebb1b12c7756d.pdf?index=trueIn PDF document text
    • https://4b4ea461-5266-411b-8735-d5290551f550.filesusr.com/ugd/7fedcf_35653e3d0a3b4ac6afb502de0d9c657e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bidemewufa/how_to_clear_a_faucet_aerator.pdfIn PDF document text
    • https://601bead5-a720-4f65-98db-62fe2a42cb91.filesusr.com/ugd/0e52b4_f8a4bbc98e0c472181b5dd4d5361edfd.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/edce7810-b1e7-49a7-b68b-16167fceda5d/they_say_i_say_the_moves_that_matter_in_academic_writing_third_edition.pdfIn PDF document text
    • https://083189c9-8220-4687-a375-57be19a37228.filesusr.com/ugd/909b15_84522a54db8c492997f678c4528d1146.pdf?index=trueIn PDF document text
    • https://c3d762b3-5d50-4891-ab6d-43710edd2423.filesusr.com/ugd/3254bf_878f190354434ad3ae61bb935ba0ecf1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lerezazo/fawanefelarabesuwomikuwu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/15246bae-1d7f-4228-be24-4d8583ab1592/44757726764.pdfIn PDF document text
    • https://9afb1793-bc57-4514-bb46-74e980466609.filesusr.com/ugd/11f207_539ccef289c44c478dbb076eceb7a252.pdf?index=trueIn PDF document text
    • https://45180a89-8b92-4d54-a4c6-cdf0ad6af3c7.filesusr.com/ugd/2b98a3_042a3d7c2f164835ad4876b271d19b89.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC45 5608 bytes
SHA-256: b07d3007f021720405a8d2db46f865c874e0854f2fe556ae96ab278c333d9df2
font_01_sfnt_off0000ff37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF37 11024 bytes
SHA-256: 70a1d12476db717269cf18a238b56bff1dbf4084828e27d3dc8b110fa68d609a

Open this report in the interactive analyzer, or submit your own file for analysis.