Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2a1d511129f3e7d…

MALICIOUS

PDF

77.2 KB Created: 2021-05-16 13:10:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: d66023ad756f393641c4cf18f01ca86f SHA-1: 9dcf1e4d2c420eb6179748655467d8e1c2dd702e SHA-256: f2a1d511129f3e7d0f8c478a3878eb61f1e853dcc43f4ed14812eb12cb56d215
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=ingersoll+rand+t30+air+compressor+oil+type PDF link annotation
    • https://cdn.sqhk.co/matelasoguje/deijgcu/50067908366.pdfIn PDF document text
    • https://cdn.sqhk.co/fasegibuniz/Xifhhgj/dikekorojaxujo.pdfIn PDF document text
    • http://zisezamerares.mygamesonline.org/54079340709.pdfIn PDF document text
    • https://cdn.sqhk.co/batumozi/7jbkMja/81661070759.pdfIn PDF document text
    • http://mosomupusafebin.medianewsonline.com/lebinogividurasevusibemu.pdfIn PDF document text
    • https://cdn.sqhk.co/vizakifito/hb2gcge/buwufoziwogakija.pdfIn PDF document text
    • http://wamabivunufoteg.medianewsonline.com/63531690688.pdfIn PDF document text
    • https://ranadapibefa.weebly.com/uploads/1/3/0/8/130874213/c8a11.pdfIn PDF document text
    • http://gopagafab.medianewsonline.com/ca_inter_books_for_may_2020.pdfIn PDF document text
    • https://kowijifeno.weebly.com/uploads/1/3/5/3/135390944/rupepomeb.pdfIn PDF document text
    • https://wowajonaj.weebly.com/uploads/1/3/4/7/134717857/af52bd6a5c8f.pdfIn PDF document text
    • http://zugapuvu.mywebcommunity.org/tivovawukuzek.pdfIn PDF document text
    • http://sekelenogake.getenjoyment.net/how_to_fix_a_surging_engine.pdfIn PDF document text
    • https://revugegan.weebly.com/uploads/1/3/4/6/134682990/8413188.pdfIn PDF document text
    • http://tafugegajotu.mygamesonline.org/chicken_with_gimpy_leg_injured.pdfIn PDF document text
    • https://fobepomakiroka.weebly.com/uploads/1/3/0/8/130874330/4d9d014.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rekorewexidiwo/the_seven_basic_plots_amazon.pdfIn PDF document text
    • https://d0a6b1b1-1773-4622-8b5e-0ab5990a7ed3.filesusr.com/ugd/b90ba1_9f29e90ec3bc4ee0bb63cb917bc798cc.pdf?index=trueIn PDF document text
    • http://gagugitebuf.atwebpages.com/94200325029.pdfIn PDF document text
    • https://s3.amazonaws.com/lezerawe/death_bed_fingerstyle_tabs_ukulele.pdfIn PDF document text
    • https://7fc1e5b2-1dd8-4457-9de2-3dea1ab9f589.filesusr.com/ugd/fedd61_158dfd5773084cf7b737f4e3f453b207.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bededuxotulapil/georgia_driving_test_practice_signs.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibudasagas/wifigojijabajodidexut.pdfIn PDF document text
    • https://s3.amazonaws.com/zalomi/technology_angel_investors.pdfIn PDF document text
    • https://9e269ae7-c3cf-4b9f-bde2-1d9be064b7bf.filesusr.com/ugd/139869_42c76b4d8f9543849368bec67a601861.pdf?index=trueIn PDF document text
    • https://eac5c218-d238-408c-98a6-8ff0ecbb25fc.filesusr.com/ugd/b1277d_ad84340ea21d4abcb64387e0fa74b005.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eddb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDDB 5740 bytes
SHA-256: d0bd36a40ddf797c3ce69df6090fa85ff524f0a880089ca5c23d3eecf304333a
font_01_sfnt_off00010156.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10156 10984 bytes
SHA-256: c175d3a9aed2d301525b069dc36f82a5b624320d8b4cb24252ed9c02da117e74

Open this report in the interactive analyzer, or submit your own file for analysis.