Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6e0934c25ad825d…

MALICIOUS

PDF

76.0 KB Created: 2021-05-31 16:22:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: faaabbcc3cc6326b2d00cc8963116186 SHA-1: 6de66b3abfc02ab2b84e2aac623fbbe9b0a09b50 SHA-256: f6e0934c25ad825d8cf3e7bc9a00f533e3ef484841107cd4020d44a6c0c5693a
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by both ClamAV and an ML classifier. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing operation. The document body, though partially corrupted, contains text related to academic exercises, which is likely a lure to disguise the malicious intent of redirecting users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9775

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wastran.ru/pbw?utm_term=concordancia+verbal+e+nominal+exercicios+com+gabarito+8+ano PDF link annotation
    • https://zigizawinowola.weebly.com/uploads/1/3/4/4/134457077/loxujusomesubev-jewed-jidakikidaliko-mekirasibajeza.pdfIn PDF document text
    • https://puxupukesif.weebly.com/uploads/1/3/0/8/130813524/bikusavevowemixod.pdfIn PDF document text
    • https://kuxozofaxaxasij.weebly.com/uploads/1/3/5/3/135325708/aa72015d509f4.pdfIn PDF document text
    • https://biforowur.weebly.com/uploads/1/3/7/5/137513749/aeeb2c65.pdfIn PDF document text
    • https://puvedevedumu.weebly.com/uploads/1/3/1/4/131406841/vivazuxikerix.pdfIn PDF document text
    • https://rulodewarozuw.weebly.com/uploads/1/3/4/6/134678260/2665276.pdfIn PDF document text
    • https://wixalotoduf.weebly.com/uploads/1/3/5/3/135305273/188670.pdfIn PDF document text
    • https://fepexugoroba.weebly.com/uploads/1/3/4/4/134469665/7007160.pdfIn PDF document text
    • https://tibejupevuk.weebly.com/uploads/1/3/4/4/134470882/tutawelewojatuwo.pdfIn PDF document text
    • https://jewefero.weebly.com/uploads/1/3/1/3/131383264/e5f6911fe.pdfIn PDF document text
    • https://nejalebemenogun.weebly.com/uploads/1/3/1/0/131070187/c77a81ff.pdfIn PDF document text
    • https://kakexesasag.weebly.com/uploads/1/3/4/6/134614155/rikozi_tuzigobajisug_tugiwapugaxiwov.pdfIn PDF document text
    • https://lepebixetuvenal.weebly.com/uploads/1/3/4/6/134634058/poralulerawusuz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2241a573-bc97-42b9-87bf-485627a13b57/race_to_witch_mountain_full_movie_in_hindi_dubbed_download_720p.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb1fc405-0c13-4a68-bd18-9cb23be39c91/pet_sematary_1989_-_gages_death_scene_4_10_movieclips.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88bf6281-7e70-4c43-85d2-e41deb3d6885/galasoniwobutasipigup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bafd1f61-5ee7-4364-bffa-2cbc5c60d9c5/bollinger_bands_equation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b7e965f-2505-4b5f-8f03-35a9816532f7/xisetevosubopijufaw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e639471e-6dc1-475d-a150-b2c7fa36a3e5/diccionario_enciclopedico_biblico_ilustrado_clie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c4d58bc-06db-4218-aafa-3b9efe5cf3df/petty_cash_report_format_in_excel.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8DA 5624 bytes
SHA-256: 204c47baee9d44f72d5bc0c9075ae0e406d76a445a2bf0bdea3c464684c6c0be
font_01_sfnt_off00010bdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BDD 10596 bytes
SHA-256: 2f01a3ea684ddc72b16ef864ae3e91d1c329cb7369d3c717144f7885714e02ad

Open this report in the interactive analyzer, or submit your own file for analysis.