Malicious PDF — malware analysis report

Static analysis result for SHA-256 ffba0f45e957ff0e…

MALICIOUS

PDF

85.5 KB Created: 2021-06-01 21:07:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: dff136d01f34eb2d79faaf3df8accad9 SHA-1: e37544462d53ee965ce913af92cfca07b9bb7165 SHA-256: ffba0f45e957ff0e85b2726de2bf19f139b51763c941885eb835046c4f377be0
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with one prominent URL pointing to a suspicious domain ('allytemp.ru') that is likely used for phishing or malware distribution. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for multiple links, further supporting a malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded links suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://allytemp.ru/pbw?utm_term=mapamundi+con+los+tropicos+de+cancer+y+capricornio PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4470967/normal_6011e041c0faf.pdfIn PDF document text
    • https://vibejatixulaxa.weebly.com/uploads/1/3/4/1/134131444/xilojokifiwimowa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387417/normal_5ff4e036d9a87.pdfIn PDF document text
    • https://kidepexabosu.weebly.com/uploads/1/3/4/2/134266059/c2030c533.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381539/normal_5ffdc4583278c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380530/normal_5fe75a215c468.pdfIn PDF document text
    • https://jowoxivodatut.weebly.com/uploads/1/3/4/8/134851862/guguxogi-nixerotuziju-wijetibeveminuv.pdfIn PDF document text
    • https://bezatawe.weebly.com/uploads/1/3/0/9/130968967/zanaxexututamem.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404520/normal_601aa00a04ac7.pdfIn PDF document text
    • https://visosoduvevup.weebly.com/uploads/1/3/4/2/134234588/910701858.pdfIn PDF document text
    • https://dapobatajixafaw.weebly.com/uploads/1/3/4/3/134310280/jokuza-fiwazekataso-xepof-getuna.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381551/normal_604422204613c.pdfIn PDF document text
    • https://sotokogel.weebly.com/uploads/1/3/4/2/134266154/0c0085aa50.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393359/normal_5ff64f88bd098.pdfIn PDF document text
    • https://wopixidotawus.weebly.com/uploads/1/3/4/5/134506387/witexuxeropimuf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488809/normal_601c64bb5c01a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426695/normal_5fcfac9fe787b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://wixugigir.pbworks.com/f/critical_thinking_concepts_and_tools_richard_paul.pdfIn PDF document text
    • http://lebunurivugu.pbworks.com/w/file/fetch/144449988/63227806074.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad02758e-b493-4fce-bd9f-b8ce0678b19f/61779842373.pdfIn PDF document text
    • http://rasovuxosew.pbworks.com/f/pokemon_ultra_sun_and_moon_free_download_codes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4532d4d-eaa3-426e-acb1-4ee20006f657/lezovutamadixevapozolike.pdfIn PDF document text
    • http://nunaruribeg.pbworks.com/f/jitenukagaloxusodinomadow.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87467914-ed90-4d7b-8284-8de1ecde20a0/8170689264.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/679c623c-4ce3-4ac7-a0d5-fc5df74754d6/gapubukavegadevome.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3B7 5324 bytes
SHA-256: 56963e8563f82621276ebbfb48a8fa6f9c25315ac09f63fb899d2a5b735d8d13
font_01_sfnt_off000105cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105CF 13448 bytes
SHA-256: adb69f0c7b5e78197e56802c05e22a459a5c3a013bab508ccd8332ced155e918
font_02_sfnt_off0001317d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1317D 16060 bytes
SHA-256: 84d5bd19c210eb3b73ecc14096ab1e56fdfb5b80ce7ba4f0052c67c0c2b02727

Open this report in the interactive analyzer, or submit your own file for analysis.