Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa3340cfb129541c…

MALICIOUS

PDF

86.7 KB Created: 2021-04-19 18:02:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 426c65be39fedc75ffa9bef4dd1446d0 SHA-1: 6330f119854a7f3f86b4a9ab4e8fc908893ebd15 SHA-256: fa3340cfb129541cad1ee91923446d39c56fdaf99e4a840be32bee290f5dd2f9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple external URIs, with a high-confidence ML classifier and ClamAV detection indicating malicious intent. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests a deliberate attempt to obscure the true destination by using numerous disposable domains. The primary malicious URL identified is https://fokemale.ru/strik?utm_term=gramatica+espa%25C3%25B1ol+libro+pdf, which is likely used to deliver a secondary payload or redirect to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=gramatica+espa%25C3%25B1ol+libro+pdf PDF link annotation
    • http://pasetbs.xyz/kinamilidamibetinisunz0ev.pdfIn PDF document text
    • https://cdn.sqhk.co/norejasiwiza/hjSojcy/35433928602.pdfIn PDF document text
    • http://rodina38.ru/rufuvivezifir8094e.pdfIn PDF document text
    • https://cdn.sqhk.co/jesovolavig/pnl2jhh/ralesavaxizuvugewezid.pdfIn PDF document text
    • http://fitatuvepejozo.sportsontheweb.net/manibafutemekikuzapedu.pdfIn PDF document text
    • https://cdn.sqhk.co/norekabalak/icdifid/adobe_captivate_2019_voices.pdfIn PDF document text
    • http://povisowalikim.scienceontheweb.net/4th_grade_math_multi_step_word_problems.pdfIn PDF document text
    • http://helpcenter.business/what_are_the_advantages_and_disadvantages_of_bill_of_exchange2j3rc.pdfIn PDF document text
    • http://parrrtner.xyz/3312296996hneox.pdfIn PDF document text
    • https://cdn.sqhk.co/jawutuwek/ghjbgiT/buvataw.pdfIn PDF document text
    • http://bewewafip.scienceontheweb.net/pomowovapilo.pdfIn PDF document text
    • https://cdn.sqhk.co/vujenibolo/iShgih9/vuvusuwagadanalipaxe.pdfIn PDF document text
    • http://nekretnine.site/83698401499bihi4.pdfIn PDF document text
    • http://ruguwafe.scienceontheweb.net/32107771340.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://1b6fbac1-9b66-4609-9151-81f5d4c316f7.filesusr.com/ugd/5e81b9_51da4b67d5d343e5a7697ca3e2f572ca.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d99e989e-b280-4e64-aa61-75ebac23beea/28312964501.pdfIn PDF document text
    • https://s3.amazonaws.com/lokijuronig/beats_audio_sound_driver.pdfIn PDF document text
    • https://fdf0fb27-5181-4190-8e1a-80fb86d87eb1.filesusr.com/ugd/2410c9_8fe40659c35743d9ab70d4bf851205ef.pdf?index=trueIn PDF document text
    • https://460eb545-5389-4aa9-9e78-d1074a8bca0c.filesusr.com/ugd/21a131_23de68912ddd456388ca6c609fefd502.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/ximupuv/soxaxexer.pdfIn PDF document text
    • https://6558ac43-984d-4e3a-97a1-dec8860611ed.filesusr.com/ugd/c73740_751e8140642345f3b8b6716c8a4c3cf7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/winumigutam/polk_surroundbar_5000_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ca58d56-745e-4948-a4c3-469220ba9e33/magic_the_gathering_deck_construction_rules.pdfIn PDF document text
    • https://e1bd05e7-a2ed-43df-b5fc-9bc8ee0b1a84.filesusr.com/ugd/08acf3_5de0751f6de7430bac0ab3c8c9cc8661.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/20d5bd9a-b84f-4845-b2fd-376e63cba719/99368682459.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE8A 5684 bytes
SHA-256: f7c66093a5fc926a74f40446cf7ee3c6e55b5ce6812e6f7b0caa2f024d1922ff
font_01_sfnt_off0001017a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1017A 3000 bytes
SHA-256: fca2eb9f674c241dadeac9b5ef7cf697aacc5fcfa9e5d7c626713ecb3393b124
font_02_sfnt_off00010d9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D9F 11948 bytes
SHA-256: 553ee6456af53b6e0fa4d9e5b9aa02904a51f53c35d0fbf29e1e379a71ba9d19
font_03_sfnt_off000134a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134A1 16344 bytes
SHA-256: 9cfb1cab620b64281c2de88f538aef1596cb111f13e0e66dcc25bab0e7ea6164

Open this report in the interactive analyzer, or submit your own file for analysis.