Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6f1fe70ba8d99f5…

MALICIOUS

PDF

87.6 KB Created: 2021-05-22 22:48:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: b134605743f331d1dbff034270e64724 SHA-1: 0f27e4855b7e8954e54b98d42038802b4dcbb29d SHA-256: f6f1fe70ba8d99f59e2a713b6d75c2f9c8b09743febcbf5ea1e47ee081dc67a8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, a technique often used for SEO manipulation to promote malicious content or phishing sites. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates this malicious intent. The embedded URL points to a suspicious domain, likely part of the link farm's purpose. While no scripts were directly extracted, the PDF structure and heuristics suggest a phishing or malicious content promotion scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=https+%252F%252Fgestime.aphp.fr+mon+compte PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4458625/normal_6018422b4cec2.pdfIn PDF document text
    • https://totamozosapopa.weebly.com/uploads/1/3/4/7/134712517/selezutidepoziled.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497131/normal_601f69efb179a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415930/normal_604736d4ad8e4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421354/normal_606891583ec6e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443619/normal_6020269d84012.pdfIn PDF document text
    • https://xadifopelizil.weebly.com/uploads/1/3/4/7/134771643/1f015129.pdfIn PDF document text
    • https://damasijirezox.weebly.com/uploads/1/3/4/5/134528919/pofekonisefimad-tefifojetu-rupakakiwep-bivosunoposimus.pdfIn PDF document text
    • https://levukuwaxumofet.weebly.com/uploads/1/3/1/3/131383949/bakoz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wuniku/kiniwopometubodiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/466bf8ab-1617-4f32-ba5c-e42152e15205/schlage_electronic_lock_battery.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb23fbb4-c34c-45c8-add3-1279c79bfb8e/bissell_proheat_clearview_plus_12_amp_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01781c04-de61-437f-87a2-6c62df5f89fb/pukigavezemujoxo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3482f541-5c9b-44ec-af00-b91d3a07f150/21841687494.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae16fc35-44ab-47b3-9425-fcd5fa1190e3/sixuvosurapi.pdfIn PDF document text
    • https://s3.amazonaws.com/rekorewexidiwo/10227325628.pdfIn PDF document text
    • https://s3.amazonaws.com/xetasif/48738865084.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f351.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF351 5212 bytes
SHA-256: ed76f2e62cdffba7cea0771474ba82e40633f46b7b39ec73999b5ade247c600f
font_01_sfnt_off000104e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104E9 12824 bytes
SHA-256: dc02f96d87bde1617908d58f0a8852f58cd954d508cfffe78b29ce3c01fa64c2
font_02_sfnt_off00012dfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DFD 16124 bytes
SHA-256: aca4cc7a4adecbe8d3b69816f606a775e78e0cb22b4b713e3bf6556a18461847
font_03_sfnt_off000142e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x142E9 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.