Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3ddbd609954e520…

MALICIOUS

PDF

63.9 KB Created: 2021-06-10 11:58:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 87c0c2241d02bba2a00ca2e6957f7e44 SHA-1: ad1dd475d97f671ac1d0d85274710c42fe3bf9dc SHA-256: f3ddbd609954e520c371e73b0a1dd2378ece7e9d097b7c3d4bc97d81f87dfb05
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a link farm with 19 external URIs pointing to various PDF files, likely intended to obscure the true malicious destination. The primary URL, https://chcial.ru/pbw?utm_term=video+downloader+and+converter+mp4, suggests a lure related to downloading video conversion software. No scripts were extracted from this sample, but the presence of numerous external links and the ClamAV detection indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8602

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/pbw?utm_term=video+downloader+and+converter+mp4
    • https://derunemutojo.weebly.com/uploads/1/3/7/5/137517297/ludiwafuj_wetudob_kabug_lutaladiratu.pdf
    • https://static.s123-cdn-static.com/uploads/4482403/normal_5fce9876d0b45.pdf
    • https://zedodunojoponex.weebly.com/uploads/1/3/6/0/136083391/fobugak-kamejajen-jesejamipu.pdf
    • https://bativizamazon.weebly.com/uploads/1/3/4/7/134770744/296f9ec53.pdf
    • https://jazemajotejavux.weebly.com/uploads/1/3/2/6/132681398/jujoxozoxapavalo.pdf
    • https://sasegedowitigi.weebly.com/uploads/1/3/4/8/134895647/804544.pdf
    • https://rizapomon.weebly.com/uploads/1/3/0/7/130739727/0be2787d8e3316f.pdf
    • https://gizibufunete.weebly.com/uploads/1/3/4/4/134492386/bezosabelelon.pdf
    • https://nikonewakudofu.weebly.com/uploads/1/3/2/3/132303001/3073784.pdf
    • https://cdn-cms.f-static.net/uploads/4375705/normal_5fe89b601d3e1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5a50825c-f2f8-408a-b3d9-65fe5d59ce4b/17309433560.pdf
    • http://vikiruji.pbworks.com/w/file/fetch/144716889/vidazudiwosaneka.pdf
    • http://tisowowuduwe.pbworks.com/w/file/fetch/144596070/revolucin_solar_interpretacin.pdf
    • http://welomobo.pbworks.com/w/file/fetch/144604140/bikini_bottom_genetics_worksheet_2.pdf
    • http://nusometa.pbworks.com/f/nicki_minaj_queen_album_download_zip.pdf
    • http://fulusivijomu.pbworks.com/w/file/fetch/144436968/jibexalinerageru.pdf
    • https://uploads.strikinglycdn.com/files/412317fd-fd32-451c-93b7-f3ed7d7c11ae/rimuzolaboxavuvagokito.pdf
    • http://guronavageba.pbworks.com/w/file/fetch/144486831/holt_mcdougal_biology_study_guide_a_section_1_manipulating_dna.pdf
    • http://funuvutidip.pbworks.com/f/21723647664.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e335.bin
dd74e08c1152310f0a9cb114ce08e06d228d9d9a08ce4ceffb7631b48b273a64
pdf-font-stream PDF embedded font (sfnt) at offset 0xE335 5248 bytes