Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3730f5664b558bd…

MALICIOUS

PDF

80.6 KB Created: 2021-03-13 23:12:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 8e6c670309a3aecfe84b1ed2f6f3d528 SHA-1: 807804f50c51b634bf022096da16047b2c9cd2f0 SHA-256: f3730f5664b558bde02729866bbf046b04f0731b6a376cf9dab8c16e97997687
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating it likely exploits a vulnerability or hosts malicious content. It contains a large number of external links, suggesting it functions as a link farm, potentially for SEO manipulation or to redirect users to phishing sites. The presence of multiple external URIs and the PDF_SEO_LINK_FARM heuristic strongly support this attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=physics+study+guide+pdf+grade+11 PDF link annotation
    • https://dudegakabiwuzab.weebly.com/uploads/1/3/1/4/131406663/f9d097ef.pdfIn PDF document text
    • https://dupudebokuvufex.weebly.com/uploads/1/3/2/3/132303235/6d9bac55cceec8b.pdfIn PDF document text
    • https://cdn.sqhk.co/zogameva/jihfhgm/67979037753.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387817/normal_5fe1a91fb2e1c.pdfIn PDF document text
    • https://cdn.sqhk.co/ralapogifur/Tr9jfgd/turbo_speed_car_racing_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/goluxewimabu/MhfRhjL/nipowudisevevudigogupu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491169/normal_5fd9a1493046e.pdfIn PDF document text
    • https://xutesinazered.weebly.com/uploads/1/3/4/5/134529246/lareniwatazibi.pdfIn PDF document text
    • https://cdn.sqhk.co/dusaradezat/NhaKzxk/bombas_socks_reviews_no_show.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476148/normal_602d4dc3403c6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460688/normal_60302c6a4d3b6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405440/normal_602ad74d648cf.pdfIn PDF document text
    • https://xebuwonivaxatev.weebly.com/uploads/1/3/2/6/132696015/79e62.pdfIn PDF document text
    • https://vuxutuwatojo.weebly.com/uploads/1/3/4/6/134625262/wudunox_nunuvapalufa_gumetunidawigu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://550dfcec-0280-4316-a0d5-68b74a7a20b9.filesusr.com/ugd/f59309_b6277641053444ce904921befc2f96a6.pdf?index=trueIn PDF document text
    • https://bb491b24-4c81-4ccc-8daa-bf1baeb171c2.filesusr.com/ugd/93c935_388edcdcac384dafaa01e7576156290e.pdf?index=trueIn PDF document text
    • http://zevusup.atwebpages.com/how_to_start_cyber_security_career.pdfIn PDF document text
    • http://bifovigavij.myartsonline.com/tejerawa.pdfIn PDF document text
    • https://e61e9f85-32c5-4861-9fd4-b89109084c35.filesusr.com/ugd/2e4eb4_5c1cabf1ffb4418badc53957d004197a.pdf?index=trueIn PDF document text
    • https://6d4cd3b7-91e9-43ac-92b9-205473f1e50d.filesusr.com/ugd/28146e_ca874bc86e004e98b43670e59a2ece5c.pdf?index=trueIn PDF document text
    • https://9eff4bf0-55a5-42b9-a65a-250f23c32afd.filesusr.com/ugd/80978b_e66ec5cc3c7c44358122887616a0c399.pdf?index=trueIn PDF document text
    • https://35e1cc1d-5f6c-4a41-9b1b-b9ae8dddc97a.filesusr.com/ugd/351eee_03bbc91f3c1a49849a197c807a234da2.pdf?index=trueIn PDF document text
    • https://9ebe8999-295a-4f11-87dc-c96f3e1b46ff.filesusr.com/ugd/8de238_f73066369dcc44cf95864ef77919d162.pdf?index=trueIn PDF document text
    • https://80b2a579-f9ed-4aa0-b91a-ac3c8973c086.filesusr.com/ugd/353d00_38de0e637a1b46f8879c4b3f60824871.pdf?index=trueIn PDF document text
    • https://d926c97b-7f3b-4ec8-a52a-318bcb589338.filesusr.com/ugd/120f26_66a2af932b464d76aa9e8c2e6e9c7e36.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE79 5540 bytes
SHA-256: 547997b2aa4424b8c704d0e5db7b089ab7c92ef0848c4057b6fc1d5c0768cc90
font_01_sfnt_off0001115f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1115F 10216 bytes
SHA-256: c60a2fefd26b2c38da8ccc2872645a8b294fa1d96cd3157d63eec050b578000b

Open this report in the interactive analyzer, or submit your own file for analysis.