Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2b420b113dcef50…

MALICIOUS

PDF

69.6 KB Created: 2021-01-17 16:18:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: c6f6f3a22e0e1f09ad19bc00807e16e6 SHA-1: c676048588d81ef05699af9e0ee7272015085d54 SHA-256: f2b420b113dcef50beb678db07bf2c553d211c438ba6cd5e8a2f47493121c9d2
242 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to external PDFs hosted on disposable domains or potentially malicious redirectors, as indicated by the 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'PDF_SEO_LINK_FARM' heuristics. The ML classifier also flagged this PDF with high confidence. While no scripts were extracted, the structure suggests a phishing or SEO spam campaign designed to lead users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9695

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=animation+wallpaper+for+desktop+free In PDF document text
    • https://site-1245376.mozfiles.com/files/1245376/vidyasiri_application_form_2018-_19.pdfIn PDF document text
    • https://cdn.sqhk.co/jutigurotow/U6JjXhf/14687383035.pdfIn PDF document text
    • https://cdn.sqhk.co/lolajelor/jgfzEjh/fofilisixiv.pdfIn PDF document text
    • https://site-1191111.mozfiles.com/files/1191111/90189060560.pdfIn PDF document text
    • http://dasonudulikuvon.22web.org/88570187114.pdfIn PDF document text
    • https://nolaguga.weebly.com/uploads/1/3/4/3/134307058/petagesa-kikaporaxu-fiwapib.pdfIn PDF document text
    • https://cdn.sqhk.co/podadoxafa/bjatbji/arena_definition_in_sociology.pdfIn PDF document text
    • https://cdn.sqhk.co/poturofivat/Gt8KHih/41379518709.pdfIn PDF document text
    • https://site-1175091.mozfiles.com/files/1175091/ralixegemawes.pdfIn PDF document text
    • http://dixojele.22web.org/37515130270.pdfIn PDF document text
    • https://site-1250423.mozfiles.com/files/1250423/bible_genesis_to_revelation_guide.pdfIn PDF document text
    • https://site-1195137.mozfiles.com/files/1195137/608702851.pdfIn PDF document text
    • https://vesekukoluvili.weebly.com/uploads/1/3/4/7/134759730/fusazisotaxivop.pdfIn PDF document text
    • https://jaloteke.weebly.com/uploads/1/3/4/0/134096083/6340007.pdfIn PDF document text
    • https://cdn.sqhk.co/vizinifum/Hggijii/heart_star_symbol_keyboard.pdfIn PDF document text
    • https://fapopadiwa.weebly.com/uploads/1/3/1/4/131438416/3984210.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xamibudasagas/erin_meyer_the_culture_map.pdfIn PDF document text
    • https://s3.amazonaws.com/bidurudilidujug/canopy_growth_corporation_annual_report.pdfIn PDF document text
    • https://s3.amazonaws.com/farezelof/69441080812.pdfIn PDF document text
    • http://pobediwawe.epizy.com/viloze.pdfIn PDF document text
    • https://s3.amazonaws.com/fobupojowojon/toyota_auris_2014_repair_manual.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001084d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1084D 5332 bytes
SHA-256: fc05380eb78cbf183e35fa5fb415caa2f3b4b1b387fb966130416d49bcd990ad

Open this report in the interactive analyzer, or submit your own file for analysis.