Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd7df2ec4ab7203a…

MALICIOUS

PDF

80.8 KB Created: 2021-04-02 16:14:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: c32f3bc94aad1b1ccf8993677fb962db SHA-1: c3afd4b57e064c609105f69de17ad0239b9df62d SHA-256: fd7df2ec4ab7203a00b40080abc895a3d9e43a1f91916ef1b894612581872b18
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The embedded URLs and the document's structure suggest it is part of a link farm designed to redirect users to potentially malicious content, specifically advertising a 'video player apk for android tv'. The presence of external URIs and the link farm heuristic strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=video+player+apk+for+android+tv PDF link annotation
    • http://ginixotojaru.medianewsonline.com/31624341059.pdfIn PDF document text
    • http://pililiriniru.mypressonline.com/3m_double_sided_tape.pdfIn PDF document text
    • https://jexetapi.weebly.com/uploads/1/3/4/3/134345775/9475361.pdfIn PDF document text
    • http://apeech.ru/64004071820cdgnu.pdfIn PDF document text
    • http://masajsalonunuz.com/9420278741wnxx9.pdfIn PDF document text
    • http://freshmind.net/cooks_essentials_2qt_digital_stainless_steel_pressure_cookera72k6.pdfIn PDF document text
    • http://fikosarodone.medianewsonline.com/annihilation_of_caste_book_free_download.pdfIn PDF document text
    • http://instacopyrighthelpteam.com/43567161086ruif3.pdfIn PDF document text
    • https://dugepenen.weebly.com/uploads/1/3/1/3/131379306/jelikemitavunemuture.pdfIn PDF document text
    • http://eurofamily.pro/2011_jeep_grand_cherokee_overland_5.7_hemi_review3i8n3.pdfIn PDF document text
    • http://fewutame.getenjoyment.net/mgl_adherence_scale.pdfIn PDF document text
    • http://dapajibidamazed.mypressonline.com/download_manga_akame_ga_kill_bahasa_indonesia.pdfIn PDF document text
    • http://leporabev.mywebcommunity.org/88450350843.pdfIn PDF document text
    • http://nutosuvitiraj.scienceontheweb.net/xikoluwo.pdfIn PDF document text
    • https://tafugamukizigip.weebly.com/uploads/1/3/0/7/130775106/dajami-getavif-xewivi.pdfIn PDF document text
    • https://xadadoroz.weebly.com/uploads/1/3/6/0/136024884/5227132.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://203e60c5-e32a-4587-ab6d-31d66de6d5b9.filesusr.com/ugd/014c36_dbf891d5b9324f97986e94442bfa2022.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/feborobegibew/chicago_style_font_size.pdfIn PDF document text
    • http://moxapowi.myartsonline.com/kepisax.pdfIn PDF document text
    • https://s3.amazonaws.com/zewimu/95257481875.pdfIn PDF document text
    • https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_bc3003bf057f400c933051cb47004e39.pdf?index=trueIn PDF document text
    • http://nafaradevofipaf.myartsonline.com/98146665089.pdfIn PDF document text
    • https://8c805f22-5240-4a8e-9b4d-8499607ff1fc.filesusr.com/ugd/76156b_fec9c76c24144cf9b80a0510c17f119c.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f47f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF47F 5048 bytes
SHA-256: ef62298d4d5914d759773de008b8f3b8f505295b49472711cc587d63f94afeec
font_01_sfnt_off000105d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105D3 14696 bytes
SHA-256: cb8a2fc05f218065a9769b673753f86a90b717e84ae95400a8fe2b5209db8994

Open this report in the interactive analyzer, or submit your own file for analysis.