Malicious PDF — malware analysis report

Static analysis result for SHA-256 f216d5573ed4de30…

MALICIOUS

PDF

161.7 KB Created: 2021-03-30 21:41:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: fa2b9dd772405d0e003b234622cfa99c SHA-1: bc7203d509194eecd21bbf9a99b270ae7b3323d5 SHA-256: f216d5573ed4de30a5cb567c370b799dc98a3b1be4360c1f086556f6f9ac4864
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with a significant number pointing to disposable domains and link farms, indicating a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a lure to external malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=uncharted+waters+online+cooking+guide PDF link annotation
    • http://timurberg.ru/gexagomunaxepowgbjcb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450730/normal_5fe9a22f926f8.pdfIn PDF document text
    • http://fragcups.com/51826442868w4mw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384851/normal_603d2076ba0fc.pdfIn PDF document text
    • http://fruitslope.online/stihl_chainsaw_model_025_chainsaw_manual2j9hr.pdfIn PDF document text
    • http://nicepics.xyz/gemela4yg0y.pdfIn PDF document text
    • http://moxumepavigotuf.iblogger.org/xoruxikokijokemazinemesuj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://pekarenov.rf.gd/sodebenimuralibi.pdfIn PDF document text
    • http://wodefelid.rf.gd/rixas.pdfIn PDF document text
    • https://9f2a6cc1-6e15-4467-beaa-57274ca996ed.filesusr.com/ugd/78f4c3_88c82b45d7bf4b8ebc86b843ea2c669d.pdf?index=trueIn PDF document text
    • https://86f5e18a-8766-4ae7-b9bf-31430b627380.filesusr.com/ugd/911c12_c710caab008f4dd4807711d9062890c5.pdf?index=trueIn PDF document text
    • http://ferobinosu.epizy.com/anencephaly.pdfIn PDF document text
    • https://c480cc3d-c044-45b7-a7fa-747782367dcd.filesusr.com/ugd/a26f59_b5edd02b09e342f5b36d255795428619.pdf?index=trueIn PDF document text
    • https://f3ea461b-95fd-44cf-949c-5afda193840f.filesusr.com/ugd/a48928_350f5757a5484d5786da97ec2d894dc4.pdf?index=trueIn PDF document text
    • https://5b2b9875-3923-4577-9ef6-0527498c95e7.filesusr.com/ugd/4e6dd5_00e85a4887fb4fbcbe42b837b45a37ac.pdf?index=trueIn PDF document text
    • https://dda5c79a-a75d-44d9-a006-48dec3bfe172.filesusr.com/ugd/115d6e_7eabe8def6a34274a3e9172f6ce00e81.pdf?index=trueIn PDF document text
    • https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_567f52b046a8435081e29a224f8562e2.pdf?index=trueIn PDF document text
    • https://8909b315-4d59-4940-aabf-0fdaa532e0ad.filesusr.com/ugd/4542d9_d4fb83cf154340dca066e00f71838f8d.pdf?index=trueIn PDF document text
    • https://d8d691c7-cf48-432b-bece-a54604b57851.filesusr.com/ugd/1e3a4b_34a76262867047d18da973654d324022.pdf?index=trueIn PDF document text
    • http://nisifibuvez.epizy.com/lic_jeevan_amar_proposal_form_download.pdfIn PDF document text
    • https://e5baaea7-7007-41de-9367-4ebf3ed55875.filesusr.com/ugd/8e1900_7629ee016bd8402796b28481043e492a.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000223c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x223C1 2896 bytes
SHA-256: f68ca040ff5829d08d4bb6bdf1d80f8c62497358b93798cf9e66a553993eb265
font_01_sfnt_off00022e13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22E13 5348 bytes
SHA-256: 43492b4a71282f6794f197fa58a1014712c1c26afb11e8e0f95a60384c9ac2f6
font_02_sfnt_off00024048.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24048 6068 bytes
SHA-256: 58b4873d33ac9fffaf45ed1a2312b8eb5fadf3b067e77f8cfe9e87095f6a7717
font_03_sfnt_off00024ff9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24FF9 11816 bytes
SHA-256: 405802d10cae57a5accc08f985b4601ae48cc7753d34fa2f43a17e9969ab039f