Malicious PDF — malware analysis report

Static analysis result for SHA-256 f28aea09f6da6ebf…

MALICIOUS

PDF

84.3 KB Created: 2021-05-02 22:45:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 886c63a10b897085a2c8985a74688bff SHA-1: 84b290b13b6b6880d00949354160b18a02376c00 SHA-256: f28aea09f6da6ebfd2f15cc5ae526e97e922edae75dd71a725e798cf0164fff3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=pioneer+mini+split+owners+manual PDF link annotation
    • https://xidakagufade.weebly.com/uploads/1/3/4/4/134400986/1772720.pdfIn PDF document text
    • http://roskycnmx.com/71116226228bqzfr.pdfIn PDF document text
    • https://megafibi.weebly.com/uploads/1/3/4/3/134347288/6ec31e7ff.pdfIn PDF document text
    • http://storeeuro.info/693991352113g9d9.pdfIn PDF document text
    • https://tidijutaxidekoz.weebly.com/uploads/1/3/4/5/134589823/158819.pdfIn PDF document text
    • http://lusififaji.iblogger.org/mokizubip.pdfIn PDF document text
    • http://vikorurapufor.iblogger.org/how_to_setup_canon_printer_with_iphone.pdfIn PDF document text
    • http://biggymstoe.com/betobatagesatikamuxanovot1p.pdfIn PDF document text
    • https://lodobapidadisu.weebly.com/uploads/1/3/1/1/131164557/rirupawora.pdfIn PDF document text
    • http://rijunoje.mygamesonline.org/2802365297.pdfIn PDF document text
    • http://pakirekugep.scienceontheweb.net/system_analysis_and_design_objective_questions_and_answers.pdfIn PDF document text
    • http://bcpzonasegur4viabcp.com/604663588128w3wg.pdfIn PDF document text
    • https://webezajafe.weebly.com/uploads/1/3/4/7/134774073/wutizigikim.pdfIn PDF document text
    • http://medicinfo.online/jafewipasuwamiw0tt8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/saxefi/60971176834.pdfIn PDF document text
    • https://s3.amazonaws.com/tasufagijaremo/cfa_level_1_study_guide_wiley.pdfIn PDF document text
    • https://s3.amazonaws.com/fatikonavori/vba_tutorial_word.pdfIn PDF document text
    • https://67389751-14cc-4ed3-b660-7ef7239e4cc3.filesusr.com/ugd/bb5584_8e047f6c6ca446e29473bbc7d78b19a0.pdf?index=trueIn PDF document text
    • https://f3ea461b-95fd-44cf-949c-5afda193840f.filesusr.com/ugd/a48928_4bf1f7e5db4142729a75358616f5a055.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wemofodi/criminal_law_legal_assistant_job_description.pdfIn PDF document text
    • http://nolazukij.epizy.com/can_humans_survive_without_electricity.pdfIn PDF document text
    • http://towudulinu.epizy.com/things_to_say_in_a_performance_review.pdfIn PDF document text
    • https://2cc935b2-b854-4d3d-8499-e3bac5ec7384.filesusr.com/ugd/2e82fc_3801e7d616d04688a204897f95f68f59.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gotijejaj/56093542779.pdfIn PDF document text
    • http://fibotujipisozu.rf.gd/how_to_connect_low_voltage_garden_lights.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A9E 5056 bytes
SHA-256: 5b008be34a2e1bc153e4edd0739765f10a8668fa4d91e5cce7cc0c6f1936c35d
font_01_sfnt_off00011bc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BC5 12236 bytes
SHA-256: 494349ae1b2206ba4ec07d7c053f0181b04442b5426e2a0012704a2f4fe93d59

Open this report in the interactive analyzer, or submit your own file for analysis.