Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd7ced66298bd1bc…

MALICIOUS

PDF

86.1 KB Created: 2021-03-25 16:52:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: b8a4764645ded9a9fe3264b9da1b1e07 SHA-1: 83d960ca9f1c42bb07205d0cee63154d55aa989e SHA-256: fd7ced66298bd1bc46a7330519d53deb8c0e71793f55260baf4cf23e660f211f
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing trojan. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO poisoning tactic. The document body, though heavily obfuscated, appears to be a lure related to "Allan holdsworth chords pdf", directing users to malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/123?utm_term=allan+holdsworth+chords+pdf PDF link annotation
    • https://cdn.sqhk.co/zedawuzijis/aqJhhif/tap_tap_punch.pdfIn PDF document text
    • https://webegerux.weebly.com/uploads/1/3/4/7/134759049/temelatopetujeroda.pdfIn PDF document text
    • https://cdn.sqhk.co/xezafube/ifhaTjf/60851514688.pdfIn PDF document text
    • http://kuvenumine.mygamesonline.org/48033025415.pdfIn PDF document text
    • http://zekojotewakugag.mypressonline.com/vufivobeb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405208/normal_60087ca2668f3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368487/normal_60257b67bfcd3.pdfIn PDF document text
    • https://tekemuwuva.weebly.com/uploads/1/3/0/7/130775778/safumife.pdfIn PDF document text
    • https://cdn.sqhk.co/gitogozune/cJghigG/the_survival_hunter_games_2_apk_mod.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415073/normal_601cffc2252c7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421350/normal_6028e38cc7ba1.pdfIn PDF document text
    • https://rumitubo.weebly.com/uploads/1/3/4/5/134525427/rejipuzefux-dagepuxuxifu-xivemep-buzuruxunenapog.pdfIn PDF document text
    • https://tepiduti.weebly.com/uploads/1/3/5/9/135974730/7954bfd.pdfIn PDF document text
    • http://xulazawelinuze.scienceontheweb.net/2901879352.pdfIn PDF document text
    • https://bakogala.weebly.com/uploads/1/3/1/3/131384254/kakeritis_welalusowajiraf_panovilomuwafo.pdfIn PDF document text
    • http://wabaxifejem.sportsontheweb.net/stock_markets_open_at_what_time.pdfIn PDF document text
    • https://cdn.sqhk.co/xamowizaso/ihBghig/fugokevaraj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://75ca6b5e-a470-4e0e-8004-b00a9f1721b4.filesusr.com/ugd/1e4819_278c24a0b98844128736dde5e396d281.pdf?index=trueIn PDF document text
    • https://86042ffc-9b62-460b-8552-fb2522205a17.filesusr.com/ugd/4f92c1_f23debecf2164868ab8f58f793bd7dd2.pdf?index=trueIn PDF document text
    • https://e53c8fcc-339b-4d8f-83f6-44ddc8c6ace4.filesusr.com/ugd/1ea9c4_3d5f0363acd942bfb0f79851cf468940.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8D6 4948 bytes
SHA-256: f4fc7554590576228825db7af675bfd4248cbeb696fbe355cfb1cbd344692c2c
font_01_sfnt_off0000f99d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF99D 1852 bytes
SHA-256: ab7952e30a868751faa025f2e14b53a51e83c417853e71d0ae878d8a5e8faa15
font_02_sfnt_off00010276.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10276 10576 bytes
SHA-256: bf665881d026acbafd8b7221354f3f19812b0bba68bfc82f591ab0e1b7478220
font_03_sfnt_off000126df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126DF 16208 bytes
SHA-256: 23fb053ee487b225b4161442c5fb1c6616ae1957d1a3293f1c91e333b45a9988
font_04_sfnt_off00013c1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13C1A 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.